By Eric Raymond
Linus's Law as described by Raymond is a claim about software development, named in honor of Linus Torvalds and formulated by Raymond in his essay and book "The Cathedral and the Bazaar" (1999). The law states that "given enough eyeballs, all bugs are shallow"; or more formally: "Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone." Presenting the code to multiple developers with the purpose of reaching consensus about its acceptance is a simple form of software reviewing. Researchers and practitioners have repeatedly shown the effectiveness of various types of reviewing process in finding bugs and security issues, and also that reviews may be more efficient than testing.
In Facts and Fallacies about Software Engineering, Robert Glass refers to the law as a "mantra" of the open source movement, but calls it a fallacy due to the lack of supporting evidence and because research has indicated that the rate at which additional bugs are uncovered does not scale linearly with the number of reviewers; rather, there is a small maximum number of useful reviewers, between two and four, and additional reviewers above this number uncover bugs at a much lower rate. While closed-source practitioners also promote stringent, independent code analysis during a software project's development, they focus on in-depth review by a few and not primarily the number of "eyeballs".
As the Heartbleed bug shows, even shallow bugs may persist in important pieces of open software—it took two years for the bug to be discovered, and the OpenSSL library containing it is used by millions of servers. Raymond said that in the case of Heartbleed, "there weren't any eyeballs".
By Linus Torvalds
In the book The Hacker Ethic and the Spirit of the Information Age (2001), Torvalds introduces his law in the prologue "What Makes Hackers Tick? a.k.a. Linus's Law", suggesting that every motivation that makes a person do something can be classified under "survival", "social life" or "entertainment". As a result, he writes, progress is defined as reaching a higher category; that is, not doing a thing merely for survival, but for social reasons, and then, even better, just for fun.
- Raymond, Eric S.. "The Cathedral and the Bazaar". catb.org.
- Raymond, Eric S. (1999). The Cathedral and the Bazaar. O'Reilly Media. p. 30. ISBN 1-56592-724-9.
- Pfleeger, Charles P.; Pfleeger, Shari Lawrence (2003). Security in Computing, 4th Ed.. Prentice Hall PTR. pp. 154–157. ISBN 0-13-239077-9.
- Glass, Robert L. (2003). Facts and Fallacies of Software Engineering. Addison-Wesley. p. 174. ISBN 0-321-11742-5. ISBN 978-0321117427.
- Howard, Michael; LeBlanc, David (2003). Writing Secure Code, 2nd. Ed.. Microsoft Press. pp. 44–45, 615. ISBN 0-7356-1722-8.
- Howard, Leblanc. p 726.
- Alex Hern, "Heartbleed: developer who introduced the error regrets 'oversight'", The Guardian, April 11, 2014 full text: "The flaw ... is almost painfully simple."
- Nicole Perlroth, "Heartbleed Highlights a Contradiction in the Web", New York Times, April 18, 2014 full text
- Himanen, Pekka; Torvalds, Linus; Castells, Manuel (2001). The Hacker Ethic. Random House. p. xiv. ISBN 0-375-50566-0.
- Jing Wang; J.M. Carroll (2011-05-27). "Behind Linus's law: A preliminary analysis of open source software peer review practices in Mozi" (PDF). Int. Conf. on Collaboration Technologies and Systems (CTS), Philadelphia, PA . IEEE Xplore Digital Library. pp. 117–124. doi:10.1109/CTS.2011.5928673. Archived from the original on 2012-09-17. Retrieved 2014-08-11.