Open source's "anyone can audit it" defense mostly rests on nobody needing to
The strongest argument for open source has always been that the code is right there — anyone can read it, so bugs and backdoors get caught. But "anyone can" is doing a lot of quiet work in that sentence.
Almost nobody reads the source of the tools they actually run. We trust widely-used projects because we assume someone else looked, and they trust us for the same reason. It's reputational trust wearing technical trust's clothes.
The XZ/liblzma backdoor is the clean example. A backdoor sat in a compression library that ships in basically every Linux distro, planted by someone who spent two years socially engineering their way into maintainer control of a project kept alive by one burned-out volunteer. It wasn't caught by code review. A Microsoft engineer noticed SSH logins were about half a second slower than expected and pulled the thread. Essentially luck.
"Many eyes make all bugs shallow" assumes the eyes are looking. For the boring, load-bearing dependencies — the exact ones most worth attacking — they mostly aren't.
I still think open source wins this over closed source; at least the eyes CAN look, and in the XZ case one eventually did. But the auditability claim feels more like a standing possibility than an actual practice. Curious how people here treat it — do you ever read the code of anything you depend on, or is it trust-by-proxy like the rest of us?
0 replies