{"id":6302,"date":"2014-09-29T10:49:38","date_gmt":"2014-09-29T14:49:38","guid":{"rendered":"http:\/\/esr.ibiblio.org\/?p=6302"},"modified":"2014-09-29T11:04:02","modified_gmt":"2014-09-29T15:04:02","slug":"shellshock-heartbleed-and-the-fallacy-of-false-prominence","status":"publish","type":"post","link":"http:\/\/esr.ibiblio.org\/?p=6302","title":{"rendered":"Shellshock, Heartbleed, and the Fallacy of False Prominence"},"content":{"rendered":"<p>In the wake of the Shellshock bug, I guess I need to repeat in public some things I said at the time of the Heartbleed bug.<\/p>\n<p>The first thing to notice here is that these bugs were found &#8211; and were findable &#8211; because of open-source scrutiny.<\/p>\n<p>There&#8217;s a &#8220;things seen versus things unseen&#8221; fallacy here that gives bugs like Heartbleed and Shellshock false prominence. We don&#8217;t know &#8211; and can&#8217;t know &#8211; how many far worse exploits lurk in proprietary code known only to crackers or the NSA.<\/p>\n<p>What we can project based on other measures of differential defect rates suggests that, however imperfect &#8220;many eyeballs&#8221; scrutiny is, &#8220;few eyeballs&#8221; or &#8220;no eyeballs&#8221; is far worse.<\/p>\n<p>I&#8217;m not handwaving when I say this; we have statistics from places like Coverity that do defect-rate measurements on both open-source and proprietary closed source products, we have academic research like the UMich fuzz papers, we have CVE lists for Internet-exposed programs, we have multiple lines of evidence.<\/p>\n<p>Everything we know tells us that while open source&#8217;s security failures may be conspicuous its successes, though invisible, are far larger.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the wake of the Shellshock bug, I guess I need to repeat in public some things I said at the time of the Heartbleed bug. The first thing to notice here is that these bugs were found &#8211; and were findable &#8211; because of open-source scrutiny. There&#8217;s a &#8220;things seen versus things unseen&#8221; fallacy&hellip; <a class=\"more-link\" href=\"http:\/\/esr.ibiblio.org\/?p=6302\">Continue reading <span class=\"screen-reader-text\">Shellshock, Heartbleed, and the Fallacy of False Prominence<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6302","post","type-post","status-publish","format-standard","hentry","category-general","entry"],"_links":{"self":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6302","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6302"}],"version-history":[{"count":3,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6302\/revisions"}],"predecessor-version":[{"id":6305,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/6302\/revisions\/6305"}],"wp:attachment":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6302"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}