Linus's law
expressionprogrammingops culture
'Given enough eyeballs, all bugs are shallow.'
Eric Raymond coined the phrase in The Cathedral and the Bazaar and named it for Linus Torvalds, as the core argument for open source's quality advantage. Heartbleed became its standing counterexample: the code was open for years, but almost nobody was actually looking. The modern reading adds the missing clause: eyeballs must be funded, qualified, and pointed at the code.
Given enough eyeballs, all bugs are shallow. Eric Raymond formulated it in The Cathedral and the Bazaar and named it after Linus Torvalds, and it became the standard argument for why open source produces secure software.
The evidence has complicated it considerably. Heartbleed sat in OpenSSL for two years, in code that everyone could read and almost nobody did, and Shellshock survived in bash for decades. The law assumes eyeballs actually look, and looking at cryptographic C is difficult, unpaid, and unrewarding, so availability of source and review of source turn out to be very different things.
What survives is the conditional. Open source enables review, and where review genuinely happens the effect is real: widely used, well-funded projects with dedicated security attention do find and fix problems faster. Where it does not happen, being open provides no protection while providing attackers the same source. The industry's response was to stop assuming and start funding, which is why initiatives to pay for audits of critical infrastructure exist at all.