I think many eyes + code audits is a good mix. It seems like OpenSSL has many eyes but the code is so incredibly complex and "big" that audits are nearly impossible (or prohibitively expensive).

Perhaps we need to hit the reset button, and have a bit more oversight into "NewSSL" with continuous audits. There are enough big players in need of secure communication that money shouldn't be a problem.

Yes, and that's how this bug was found.

So "many eyes" means "paid researches at Google and a security firm"?

Also, this bug was in place for what, two years? If the many eyes hypothesis has a two year lead time to find bugs this severe, we can stop talking about it because it's fucking worthless.

> two years

If that's how we're measuring things, then closed source isn't going to win either, e.g. [1].

[1]: http://www.computerworld.com/s/article/9146820/Microsoft_con...

A false dichotomy. Writing reliable, complex-in-function software is hard for everyone.

Many eyes worked in this case.. It just took a long time to find. The question now is what will it find next and when?

It worked in the sense that the lifeboats on the Titanic worked - they did, after all, save hundreds of lives.

The combination of time and severity in this case should mean that we can move on from naive 'all bugs are shallow' dogma towards developing a more evidence-based approach to the verification of critical software.

even with a comment in the code...