Strengthening the empirical analysis of the relationship between Linus' Law and software security

Open source software is often considered to be secure because large developer communities can be leveraged to find and fix security vulnerabilities. Eric Raymond states Linus’ Law as “many eyes make all bugs shallow”, reasoning that a diverse set of perspectives improves the quality of a software product. However, at what point does the multitude of developers become “too many cooks in the kitchen”, causing the system’s security to suffer as a result? In a previous study, we quantified Linus’ Law and “too many cooks in the kitchen” with developer activity metrics and found a statistical association between these metrics and security vulnerabilities in the Linux kernel. In the replication study reported in this paper, we performed our analysis on two additional projects: the PHP programming language and the Wireshark network protocol analyzer. We also updated our Linux kernel case study with 18 additional months of newly-discovered vulnerabilities. In all three case s...

• Type: Journal
• Year: 2010
• Where: ESEM
• Authors: Andrew Meneely, Laurie A. Williams
• Keywords: ESEM 2010, Large Developer Communities, Linux Kernel, Security Vulnerabilities, Software Engineering