A Thousand Eyes

OK, so Steve Ballmer last month said what he had to say as Microsoft CEO:

"Should there be a reason to believe that code that comes from a variety of people around the world would be higher-quality than from people who do it professionally? Why is its pedigree better than code done in a controlled fashion? I don't get that... The vulnerabilities are there. The fact that someone in China in the middle of the night patched it--there is nothing that says integrity will come out of that process. We have a process that will lead to sustainable level of quality."

And then news has recently broken out that somebody tried to slip in a back-door to Linux.

"If it had gotten out, it could have been really bad, because any Linux kernel that had this in it, anybody who had access to that machine could become root."
- Larry McVoy

Does what happened vindicate Ballmer's statements? Or does it actually break it?

I think that what happened actually lends weight to the Open Source community's idea that a thousand eyes worth of dedicated and skilled programmers may be better than a small group of paid workers.

Admittedly the problem was caught by an electronic eye. A program detected a difference between a version of Linux under development and a version repackaged for use by particular users - they should have been the same, but two lines had been added. A discussion sprang up on the linux-kernel mailing list and it became clear that this was no accidental inclusion, and that somebody had tried to deliberately add a back-door to the kernel.

Hence if somebody hadn't been paranoid enough to assume that somebody may have wanted to compromise the code, this problem wouldn't have been caught.

But let's assume that this had slipped undetected. There would have been a Linux kernel that was open to all that knew the secret. And maybe that Evil Person would have been able to cause serious damage with this exploit. However, the key point is this: as soon as more than a few people knew about this, the problem would have been looked through and fixed, and with something of this magnitude you would have had, well, a thousand eyes looking at it. Turn-around time would have been short.

Now, let's look at the closed-source model. If somebody wants to put an extremely subtle backdoor in the program and it had slipped through, with fewer resources at their disposal, MS would have taken longer to discover and fix the problem.

Let's go one step further. Let's say you suspect that there is a back-door entry in a program. You can actually check the code in an open-source model, but not in a closed-source. I wouldn't know until the program manufacturer themselves came forward with it. And even if they did, you wouldn't be able to fix it yourself.

Admittedly, not everyone's a good enough hacker to fix their own operating system, but it only takes a few to benefit the many.

However, despite all this, I believe that the Microsoft PR machinery will try to turn this to their own advantage. They will point to the fact that anyone can write code for Linux as a disadvantage - who knows what they will put in? An Easter Egg for their girlfriend? Or something more malicious? They'll saw that Open Source is inherently unsafe since any old Joe Programmer could make Evil Changes to the code.

They'll conveniently ignore the fact that the code change happened through a subversion of the normal process and that such a problem could also happen to them. They'll also not admit that if such a thing did happen to them, not a peep would make its way out to the press, so who's to know how many such problems MS have had in the past with this?

But then, money buys PR and the ability to obfuscate the truth.