Geek Speak — HabitableZone

Geek Speak » in reply to re: Current state of fixed vulnerabilities in Mozilla Firefox.

at least a dime's worth

That's a pretty good overview of the issues with open source. There are just a few areas where I'd dig in and flesh out a point or two.

Commercial organizations do have strengths that promote code quality, as long as the organization and management get behind it. Every few years Bill Gates gets fed up with the bug count and bad press, and the Redmond campus is cleansed by nuclear fire. Fairly recently, Microsoft realized that unchecked buffers were both the most common source of security vulnerabilities, as well as a common source of ordinary bugs. So--able to identify a specific problem--Bill could command his programmers to check every buffer. Open source projects don't have the safety net of a strong authority able to compel correction of problems.

A somewhat double-edge sword is the fact that Microsoft is so big that its programmers can afford to specialize deeply. My impression of Microsoft is that programmers are assigned responsibility for a small piece of the software, typically a single class; or in the case of larger classes, programmers might own just a method or two. It means that at the local level each bit of code gets obsessively polished and examined; but the downside is that most individuals don't understand the big picture. Big programming organizations compensate by creating the position of "architect", who is supposed be aware of the overall structure and ensure good "fit and finish", but in practice it means that only a very few people really understand the overall code. You might get fewer bugs at the detail level, but more bugs at the integration level.

The trick will be dis-entangling it, as much as possible...from the social movement that has advanced it to the level it is currently at.


Amen. A part of my resistance to open source comes from its historical roots in the whacky "information wants to be free" movement. I can't help but notice that its loudest advocates tend to be academics or post-IPO millionaire dilettantes whose income doesn't depend on productivity or satisfying the marketplace. How will most programmers survive in an environment actively hostile to revenue generation? Who the hell pays the bills?

I find the business/open-source partnerships to be a little dubious. Netscape puts its trashy old browser code out there as open source, and a few years later they get back Mozilla rewritten from the ground up--did Netscape contribute anything at all when you look closely? That sure looks like cynical exploitation to me. Mozilla made a gift to Netscape of R&D worth millions of dollars. There are lots of similar examples, like IBM exploiting Linux; or all the PGP code incorporated in commercial products with no royalties for Phil Zimmerman. Sure, Phil and Linus made their choice freely, but I wonder if sometimes they don't look at all the other people they've made rich and wonder if they weren't suckers.

I do share your hope that all these problems will get worked out eventually. Open source's IP issues are a subset of the broader IP issues we're having to deal with in the digital/wired age. IP is too easily copied and thus doesn't fit well within the traditional regime of tangible private property. Something's gotta give. Open source isn't the answer, but maybe it will lead to a viable answer.

Log in or register to post.

The whole thread (14 posts)