Shellshock, Heartbleed, and the Fallacy of False Prominence
<p>In the wake of the Shellshock bug, I guess I need to repeat in public some things I said at the time of the Heartbleed bug.</p>
<p>The first thing to notice here is that these bugs were found &#8211; and were findable &#8211; because of open-source scrutiny.</p>
<p>There&#8217;s a &#8220;things seen versus things unseen&#8221; fallacy here that gives bugs like Heartbleed and Shellshock false prominence. We don&#8217;t know &#8211; and can&#8217;t know &#8211; how many far worse exploits lurk in proprietary code known only to crackers or the NSA.</p>
<p>What we can project based on other measures of differential defect rates suggests that, however imperfect &#8220;many eyeballs&#8221; scrutiny is, &#8220;few eyeballs&#8221; or &#8220;no eyeballs&#8221; is far worse.</p>
<p>I&#8217;m not handwaving when I say this; we have statistics from places like Coverity that do defect-rate measurements on both open-source and proprietary closed source products, we have academic research like the UMich fuzz papers, we have CVE lists for Internet-exposed programs, we have multiple lines of evidence.</p>
<p>Everything we know tells us that while open source&#8217;s security failures may be conspicuous its successes, though invisible, are far larger.</p>
