One of the most popular open source myths is ESR’s oft-quoted statement:
given enough eyeballs all bugs are shallow
There are 2 issues with that sentiment.
Not all eyes are equal
It doesn’t matter how many accountants look at my code. Their eyeballs will not notice even a single bug.
They could just as well trying to read ancient Sumerian manuscript.
Most open source projects don’t have eyeballs to spare
Advocates could claim that open source is inherently better, more secure and has less bugs if majority of programmers were dying to look at the (open) source code and contribute code, bug fixes and documentation.
Back in the real world: lack of contributors is the biggest problem of every open source project I’ve ever seen.
Even the most sexy, most visible projects like Linux kernel, Apache or FireFox, don’t have enough developers. The smaller the project, the more desperate the contributor situation.
This has real life consequences:
- commercial software does have programmers working full time on the software so the amount of eyeballing the code is usually higher in commercial software than in your average open source project
- if you want eyeballs on your open source project, you have to plan for it