Slashdot Mirror
Are All Bugs Shallow? Questioning Linus's Law
root777 writes to point out a provocative blog piece by a Microsoft program manager, questioning one of the almost unquestioned tenets of open source development: that given enough eyeballs, all bugs are shallow. Are they? Shawn Hernan looks at DARPA's Sardonix experiment and the Coverity static-analysis bug discovery program in open source projects to conclude that perhaps not enough eyeballs are in evidence. Is he wrong? Why? "Most members of the periphery [those outside the core developer group] do not have the necessary debugging skills ... the vast numbers of 'eyeballs' apparently do not exist. ... [C]ode review is hardly all that makes software more secure. Getting software right is very, very difficult. ... Code review alone is not sufficient. Testing is not sufficient. Tools are not sufficient. Features are not sufficient. None of the things we do in isolation are sufficient. To get software truly correct, especially to get it secure, you have to address all phases of the software development lifecycle, and integrate security into the day-to-day activities."
They become a lot shallower when you can look at the source code.
As we can all see, this has gone famously for Microsoft.
...the proof is in the pudding?
What do they say?
Unless you're writing some insanely complex application like a launcher for thermonuclear missiles, you pretty much will have user error as a major instigator of bugs.
Until you get your code into the hands of users who - for example - will repeatedly hit the ENTER key wile waiting for a response, you don't have a clue what might happen.
The Kai's Semi-Updated Website Thingy
This is precisely the kind of argument you become susceptible to if you think that an attribute of software (security) is more important than your freedom. Shawn makes some good points about the technical quality of software and it's true there may not be enough eyeballs to find bugs in free software let alone hands to fix them. What Shawn would have us take from this article is that free software may not be technically superior. It's an attempt to frame the argument and shape what's people think is important in software. Unfortunately, if you care about software freedom, Microsoft's FXCop and PreFast-clean mean nothing. Their software disrespects you as a user and keeps pushing the limits in dividing and taking power away from their user base. Don't buy this line. Choose freedom first and interested parties will take care of attributes like security, ease-of-use, and compatibility over time.
Comment removed based on user account deletion
We should be careful not to let Microsoft deflect the conversation about software away from the ethics of using software you can't change, provide to your neighbor, or improve when you need more features. If the OPs conclusion is that free software may not have this particular leg to stand on in the arena of technical superiority, we must point out that freedom is our primary concern and that we each focus on security to the extent that we must obtain additional security for our software.
Except the point he is trying to make is that his code is better then the competing individual because he follows process doctrine.
Unfortunately, to make his claims stick he took a failed project as an example to support his theories. While being quite pointed in defining what projects failed he did not cite which projects of his has succeeded. This would have been at least a good starting point for a real argument.
Is good process doctrine wrong? No, it won't hurt of course, but it's not quite a kevlar vest against root shells.
Besides more examples from both sides of the camp he really does neglect several facts. Many open source projects are often led or particpated by professionals as well. In fact a recent article suggested a great more open source projects are corporate sponsored.
It's just an awful piece when you consider he is painting his enemy as both unprofessional and only arming that foe with one failed project example.
Personally, I wanted to read something useful that I could learn from and grow with, but this is pretty standard tripe.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
Since when does MS have the right to say "To get software truly correct..."? They KNOW how to make software secure?
One of my most difficult bugs was fixed by simply rescheduling the time a datamining job was to run (which was integrated in to a massive ERP system with other major components of which i had no insight). It took at least 24 hours to test everytime i created a new build. Essentially it was a scheduling ordering issue, where pre-processing of other processes wasn't done in time.. It took me a month to figure this one out. Some times the bugs are outside of the scope of your own system, and the bug will probably re-arise as data grows. I've also had some difficult threading issues where a wait is never notified caused by bad error handling, which was fixed by simply renaming a file (after 1 month of multi threaded debugging with the final session taking 3 days for one execution).
That's kinda funny.
I spent part of today working around problems with a closed source application.
The other part of the day has been working with an open source program, where I've already solved the problem, and am documenting my changes to pass back to the author for the next release.
I'm not a "core" developer for any public projects. I've never submitted a bug fix to someone like Microsoft (but have sent bug complaints that went unanswered). I have sent quite a few bug fixes for open source applications, most of which were used in future release. I'm just another guy, or as indicated, another pair of eyes.
Serious? Seriousness is well above my pay grade.
I wouldn't say that your statement is true. It's possible for a defect introduced in the requirements or design stages of development to find its way into the code, but occasionally a programmer makes an error in a loop that leads to a problem; perhaps they meant to use greater than or equal to, but only used greater than.
What process error is that other than human error? There's almost no way to ensure that human error will ever occur regardless of what type of process is being used. You can argue that proper testing should catch the bug, but not all software has the luxury of complete testing, and once again its possible that due to human error a test case is left out. I suppose that you could require the software use a formal methods to get around that, but at that point time and cost are going to become a large issue.
You can't stomp out all of the bugs during development, especially if you have some non-trivial system. One of the major benefits of open source is that third parties can and do spot bugs of this nature and can correct them or notify the developers. It's a recognition of the fact that developers aren't perfect and neither is their code.
Bugs are an error in the process, not the code. If you find a bug, you need to find the process error that allowed that bug to occur.
Agreed!
I read, with interest, the referenced article. I was expecting FUD - but I didn't find much, until I reached the Conclusion.
eg.
The many eyeballs argument is neat, tidy, compelling, and wrong.
The article starts with
Eric S. Raymond wrote , “Given enough eyeballs, all bugs are shallow.” He calls this Linus’ law.
and then attempts to refute. Fair enough. Except - the link leads to The Cathedral And The Bazaar - where I cannot find the quote... Hmmm
Now this might be relevant if the "many eyes" routine was the only form of audit used in GNU/Linux - but is not the only form of review/audit used. I'm sure other, more knowledgable posters will be able to provide more evidence than I could find in a quick search.
I call FUD
I also think a big difference is that you psychologically don't write shitty code when you think others are going to look at it.
Coders that write shitty code don't know that they write shitty code. From their perspective the code is just fine and even very good. When ever I told someone I don't like his code and challenged him to explain what he did and why, he only answered: "erm, well that is what the code should do as the requirements demand that", they had no idea what my point was and when I pointed i tout they shrugged and did not understand or value my concerns.
angel'o'sphere
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
There is a problem of deflection on another level. Most of Microsoft's problems when it comes
to security are design issues. Creating and then enforcing standards and policies with respect
to source code and development process is not going to help if the whole thing is broken as
designed. You will end up with a very consistent turd that looks good on paper.
Buffer overruns and such are not the most serious problem.
A Pirate and a Puritan look the same on a balance sheet.
...though perhaps not in the way he intends.
Look, software is *hard*. Building an OS kernel is like assembling a thousand watch movements by hand. You're going to screw up. It's not a matter of "if". There Are Always Mistakes.
Now, when he says "truly correct", I'm assuming he doesn't mean formal proving. That would be absurd, especially for an operating system as complex as Windows or Linux (or really anything with limited resources). Anything short of the formal proof and you just have empirical evidence that it works - but if there's a billion branches and trillions of code paths, nobody will hit all of them with all data.
Fact is, stuff is going to break. You can't prevent it.
So if we can't keep code from breaking - if all significant code is buggy - what's the answer? Well, with open-source code you can find a bug in your application and debug through the kernel itself, finding out why your syscall isn't returning the right information, and fix it yourself. Then everybody benefits from your work - keep in mind, you only did it (or needed to) because your application exposed a flaw. If you're using Linux 1.8 for some unholy reason, well you can fix it anyway (just nobody else will care).
But if you're using Windows, and you get bad return data from a method, your best shot is probably going to be to just coerce the data how you want it. This happens *all the time* in closed-source software - handle a buggy OS method with a special case.
So "many eyeballs" is correct, but not because there are thousands of expert code analysts poring over every git commit. It's correct because any piddly little application developer can debug the kernel itself, following his own method calls around to make sure they do the right thing. Even if he doesn't know how to fix it, he'll be able to say "doThis(*myData) isn't returning the right value" and lead the experts (writers/kernel hackers) straight to a fix.
This is the strength of open source, at least from a code quality standpoint.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
The funny thing about this article is that he essentially never mentions (a) design flaws or (b) perverse economic incentives to sell defective software. IMO these are probably the two biggest reason why MS has such a terrible reputation on security.
As an example of a design flaw, there are lots and lots of things that MS designed for ease of use, while ignoring security. MS software is way too willing to execute code in an email or on a web page just because they wanted to do something flashy without putting any responsibility on the user to know what the heck was going on. This is a design flaw. No amount of debugging will ever fully succeed in working around it.
The economic incentives to ship buggy, insecure software are also huge. Companies gather revenue by putting out a new version of the software with a long list of features. Users who buy the new version of the software generally have no way of knowing that it's full of bugs. MS is of course infamous for this.
Of course the implication of the whole article is that MS pays people to fix bugs, while nothing like that is going on in the open source world. This is complete nonsense. Most well known open-source projects are written by paid coders. But let's not let facts get in the way of MS advertising.
Find free books.
From the article:
One cannot deny the logic. In fact, it is a tautology. If you assume that all individuals have a non-zero probability of finding and fixing a bug, then all you need is "enough" individuals.
Emphasis added by me to show where I think his argument goes off the rails. "Linus' law" does not assumed that each eyeball is a bug fixer--it simply states that bugs are made shallow. Often the hardest part of fixing a bug is knowing about it, and finding it. The open source process makes it easier to do both, even if there are only a small group of coders actually fixing things.
This is not about how many software engineers you have reviewing your code. It's about how your end users can interact with the software engineers.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.
What the essay fails to capture is the nature of the functioning of the eyeballs in practice, between open source and closed source. In closed source, the eyeballs only look at what they are paid to look at, if the code is just barely good enough to sell, then out it goes and nobody looks at that code again until the complaints start rolling in and then and only the do they fix it, well, sort of fix it, they of course only fix it just barely enough to silence the noisiest of complaints and the only if there are real consequences for failing to do so. Don't think so then try this http://social.technet.microsoft.com/Search/en-GB?query=this%20is%20a%20know%20fault&ac=8 and a huge number of them have never been fixed.
Open source follows a completely different series of routes;
1) People looking for faults because they get a kick out of finding them and fixing them.
2) Tweaks to functions that indirectly remove bugs by simply replacing them with better code.
3) Discoveries in user interactions, less of a complaint because there is no force in pushing the fix.
5) Governments and government departments directly pursuing more secure code.
6) Corporations seeking to build a public reputation by demonstrating coding expertise.
So in the case of open source software there are many 'different' kinds of eyes, so those eyes all working from different perspectives do in reality make bugs very shallow. In the closed source proprietary world the bugs are buried in the depths of the code, hiding in the dark, basically because of profits versus workmanship issues, which means no light is shone on them because only one set of eyes looking from a single 'shallow' perspective looks at them.
There is of course one other set of eyes looking at code, the saboteurs both private and government, looking for faults to exploit. Hard with open source because it can rapidly turn around and bite you on the arse if you use it (if you protect against it everybody notices). Closed source (mostly but a lot of less than honourable eyes lend up looking at it), of course can be targeted as long as you, well, use open source code yourself whilst promoting closed source to everybody else (hmm, kind of reminds me of all those mainland China computer companies, odd that, isn't it).
Chaos - everything, everywhere, everywhen
I think that in Microsoft's case in particular, all the exploits out there prove the opposite of his case.
I'm not a MS dev or even anyone important, just a small business owner who fixes infected Windows machines (it's better than 3/4 of the work I do, sadly) so it seems to me that security wise at least he is way off base - the many more eyes that are looking at MS Windows without even having access to the code base are doing a pretty damned good job of finding security bugs in it.
SB
It's old. The more humans I meet, the more I like my cats. At least they are honest.
Ladies and gentleman, the article author is making a strawman argument. By transforming the "Linus' Law" into a badly written syllogism, and pointing out examples where _his invented syllogism_ fails, he's implying that closed source is _better_. Unfortunately, the vulnerabilities of closed source are often worse, by comparison and from experience.
This is a classic absolutist fallacy. The author has taken what is essentially a rhetorical way of stating a more precise claim (that bugs become more shallow with more eyes and that as you increase this number the shallowness increases). The author has then found that that statement in its most general form might not be correct or might not be the whole story. And therefore decides to throw out moderate versions of the claim. I am not impressed.
Not necessarily. If its a quick and dirty hack to get something done in a short period of time on a "temporary" basis, then its quite possible the programmer intentionally wrote "shitty code" - and KNEW it was shitty code.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
True, but that's not what he is questioning. Given two identical projects that are fairly complex (i.e. an OS kernel) he's saying that just being open source doesn't necessarily provide "more eyes". While I think there is a bit of merit to this, it certainly doesn't hurt to have more eyes possible - especially when you don't have to pay for them.
Agreed, of course. However, the converse is important, too:
Given two identical projects that are fairly complex (i.e. an OS kernel), being closed source virtually guarantees that there won't be 'more eyes'.
But the real question is: How many eyes are enough?
The answer is its own problem: Only one more pair. The tricky part is figuring out whose they are. (Yes, I'm in screaming agreement with what the OP is saying.)
It's a quality issue as much as it's a question of quantity. Ben Laurie, writing about the Debian OpenSSL Fiasco, states:
So yes, it does matter whose eyes are turned to a particular problem. The difference between FOSS/Open Source and Closed Source is therefore whether the Closed Source company has hired the right people and whether the FOSS project has gained the attention and interest of the right people.
Neither of those situations is guaranteed, but they are not at all equivalent. (Especially when we consider that for many of the best FOSS products, gaining the attention and interest of the right people is done by employing them.) Realistically, FOSS faces better odds of having bugs found and fixed, all else being equal.
Crumb's Corollary: Never bring a knife to a bun fight.
Good process might not hurt but my experience is that it is directly related to how fast many projects get mired down and never write any code. People get so involved in process that they never do anything. Process can be good but you have to avoid letting process become more important than coding. A perfect program that is never written isn't very useful.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
Let me rephrase this for him -
"For 25 years, we deliberately chose to ignore the bitter lessons that were learned by the big vendors, to take shortcuts
to ship shit software first and fix it later and to build up massive layers of cruft in the name of backward compatibility. Now we are caught in a nice pickle
as we've spent years trying fill the leaks in our crap - some of which is so insecure that, 8 years after the launch, we still have record numbers of bugs in
Windows XP almost every fucking Patch Tuesday -and restructure it into something rock solid.
However, until we can get this done, we need to play smoke and mirrors, convince you to toss Win XP - and your old PC, most likely, buy our latest
and greatest and spit out evermore FUD about how nobody else can get stuff done except us.
Ladies and gentlemen, I give you the M$ business plan and I'm pleased to say that it's working as well as ever and thank you all"
Pain is merely failure leaving the body
But at least with open source you can find and apply the proper eyes to software you did not write yourself instead of just trusting the vendor.
Ok, I've got some news for you. The quotation is not meant like an immutable law. There's a really good, important point there, but it's still just a meaningful aphorism. Let me help you with this -- when you see "given enough eyeballs, all bugs are shallow", read it as "given enough eyeballs, [almost all] bugs are shallow". Does that help? Can we move on now? This discussion is so stupid it's almost painful. Here are some other things to know: MS blog author wants attention; ESR is a self-important moron. Thank me later.
I get it, ULSER. Good one. They cause me that sort of stress too.
Freedom is your primary concern. There are certain ethical quandries that people just don't care about. For example, most people know that the low, low prices at large department stores are directly due to shabby treatment of worker in China and India, but they still shop there. Most people know that the meat, eggs and dairy that most fast food places use come from animals who live in tiny cages for all of their short lives, but people are still ordering sausage-and-egg-McMuffins. In this case, most people don't care (or even know) that the software isn't "free", all they care about is that it works the way they want it to. If you want to support free software (as I do) on ethical grounds, that's well and good. But be aware that you're digging yourself in - alienating those who don't care whether or not software is "free" by telling them that quality and security are lower priority (and if there's one thing F/OSS needs, it's more users, because users => market leverage).
So instead of brashly saying "security and quality" are low priority, why not attack the flawed argument? A F/OSS project will always have more eyes running over the code than a closed source project of equal magnitude. And to those who suggest that the closed source coders are just better, remember that open source needs less LoC (because we can use each others' code, licence and political issues notwithstanding), and as every good coder knows, every line of code is a potential bug, no matter how good the coder. F/OSS gains twice from this - firstly, we have half as many lines, and secondly, our LoCs are read twice (once by the original coder, and once by the guy re-using it). So it's not even a question of whether or not the bug is shallow - it's more that the pool is half as deep.
Open source bugs get fixed because people notice and are bothered by the bugs. This is the biggest motivator of open source contributions - everybody has an itch to scratch. The bugs that get fixed fastest are the bugs that are encountered the most. And this is why the Microsoft guy is absolutely correct in his analysis.
Bad security is not a user-facing bug. Unlike functionality bugs, there is little incentive for community members to identify and fix security bugs. Sure, the Linux kernel and other key packages will attract expert eyes, but the average random piece of open-source software will not.
Security analysis is both complicated and un-glamorous. There are not a lot of people attracted to that kind of work. There are even fewer people who would do it for free. The position of the linked article is that it's better to pay people to think about security than it is to rely on the principles of OSS. I agree 100%.
* File Locked rather than writeable by administrator for upgrade purposes.
* Ring 1 or higher code being able to write to Ring 0 locations.
* Administrative users necessary to run most things (MS software or otherwise).
* Proprietary networking.
* Lack of regression testing (LAND should just never have happened).
There's 5, who wants to take up the mantle from there.
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
Any technological endeavor human beings work towards will always be subject to "more eyeballs means improvement".
So that's why the more people there are on the committee that designed a language or protocol, the better the result. I'd always wondered about that.
One big piece of FUD here is the notion that Microsoft programmers are paid, while open source programmers are not. The open source projects I know of advance mostly because of paid programmers, and I suspect that that is the case in general. That gives them the usual capitalist incentives for finding and removing bugs.
In product after product, Microsoft continues to ship fewer vulnerabilities than our competitors.
I wish he had cited some. It does not seem to be anyone's experience, and the only study I have ever seen that said that Windows was more secure than Linux did so by counting each Linux vulnerability several times (once per distro), and comparing just Windows against entire Linux repositories.
He also looks only at whether more eyeballs are good, neglecting the disadvantage of the uniformity of the WIndows monoculture, etc.
He also argues that the Coverity scan was not an example of many eyeballs because it was government funded. So, the government paid for it - but it still happened.
He does cite some stuff including, hilariously, a study carried out in 2002 that concluded that Linux was close to becoming unmaintainable. Eight years later I am pretty sure it is being maintained.
I am also wondering about the advantages of there beinga lot of code that is shared by multiple projects. I remember a BSD code review catching an X Windows bug. In that particular case it was not fixed upstream because the XFree86 people were being awkward, but I wonder how many cases there are of stuff getting fixed.
It is also easier to report open source bugs. I have never reported a bug in a proprietary app, but I have reported lots of Linux bugs (mostly distro level, or fixable at distro level) because I can follow what it happening, and I know what the (usually good) reaction to my individual report is.
"shitty" code does not equal buggy code.
Your aesthetics, my aesthetics, or any other programmers' aesthetics are just personal opinions, don't need to be justified, and really have no particular value. On the contrary... you need to justify 100% a violation of some sort before code can be considered objectively bad, instead of just "Not how [you] would have gone about writing that, if you had been the person to write it".
As long as the code does exactly what it's supposed to do, and nothing more, and follows standard programming structure defined by the language and basic stylistic conventions (such as indentation), then the code is not shitty, no matter what my (or your) opinion is about its aesthetics.
Well I don't see people joining PETA and saying "Hey you know what, our views are a little extreme, lets try be a little more level headed".
I don't see people joining Greenpeace and saying "Hey now, Genetic Engineering's alright y'all". And lets not get started on Sea Shepard.
You also don't see hippies and vegans going to MacDonald's or Wallmart and working there in the hope to make it more ethical.
The point I am trying to make is that GNU started as the environment for people who cared about those Freedoms. Linux became part of that and is Licensed under the GPL. It is part of the Ecosystem that cares about those Freedoms. To turn around and say, well maybe those Freedoms aren't important, maybe we should become more mainstream so we can cater to the masses who like MacDonalds and Wallmart and don't care about Hens in cages or sweatshops, is kind of besides the point.
We all have our own reasons for using Linux but it would not exist without those freedoms... If you have a different view on freedoms you can also use *BSD, Solaris or something like Haiku (Etc. etc.). If you don't care, there is NOTHING that is stopping you from using Windows or OSX.
I certainly know that if I emigrated to a country and started saying people should follow my political views I certainly wouldn't be well received, it's no different with the F/OSS sphere. It is what it is. It is what it is because of what it is and really, most of us have bigger mouths than we should.
The Developers are free to do what ever they want and their projects can go in what ever directions they want them to. Users like me can be thankful for what they give us. Yes some are more rabid in proclaiming the Freedoms, but then again if a single project isn't free enough, a half-assed effort of replacing it is at least made.
Long post after a tired and long day tl;dr: Freedoms could be only a concern for a minority, but a large part of what exists is because of them. Even if they aren't the most important thing doesn't mean they aren't important.
Actually, most bugs that survive initial testing are not shallow. If they were, they'd have been caught early.
A key point of the article is that almost nobody in the open source world is really looking hard at old code. An experiment was run to encourage code review, but nobody really wants to do that. This is related to the phenomenon that many open source projects stall out at version 0.x. The basic functionality is in, the fun part has been done, and the boring grind of making the last bits work isn't getting done.
Some bugs are so deep the open source process can't fix them. Search Google for "prune_one_dentry oops". The Linux kernel is known to crash when all free memory has been taken over as file cache, a process needs memory, and due to some lock being set, file cache space can't be released. Bugs of this type have been reported steadily since 2004, and it's still not fixed. It will probably take a redesign of some fragile code to fix that, and nobody wants to take that on.
Take a look at the comment below yours, unfortunately there are still plenty of nutjobs in the free software community who equate producing closed source software with killing people.
A ridiculous amount of the linux kernel code is written by programmers paid by IBM, Intel, RedHat, etc.
Someone pays. I'm just glad it isn't me.
I think a better point for him to make might be that good software development in practice requires you pay people to do it. Who does the paying probably matters to some degree, but unpaid people are probably more inclined to solve problems interesting to them than problems which are boring but ought to be fixed.
He's arguing, probably correctly, that open source software is not necessarily secure because you can put and infinite number of eyes on it. There are not, in practice infinite number of developers available, and of the people who could be classed as developers that are available only a small percentage have meaningful skills to apply to the problem. Fair enough. I'm getting a PhD in comp sci, so on paper I'm a potential developer for linux. In practice I've never contributed anything to the linux codebase, nor have I attempted to invest the time in doing so, and I suspect I'm not alone.
I think the most important point is that lots of businesses contribute developer time to various open source projects, as do governments. But they're mostly in the business of monetizing services, on an individual basis they, like me, have no obligation to keep paying people to develop the software they service. That's a problem, since if enough of them fall on hard times the projects themselves are going to suffer, and it risks being a nasty downward spiral. For all of the things wrong with MS, if you get an operating system from them you're paying for an operating system, or a word processor or whatever, and the market for those products determines their viability, and how much developer time can be applied to them. Newspapers sell advertising space, to pay for journalism. If the market for journalism remains unchanged but the market for advertising space tanks your journalists are looking for work. If the market for whatever products the main contributors to linux sell erode away (ironically, like the car business, by making an easier to use more reliable product) there's no one actually paying for the thing which costs money to make. A sufficiently secure, stable etc. piece of software requires the minimum of support, but doesn't stay current without investment. Windows may not be the most 'current' OS in the world, but when you buy a new version M$ isn't out anything by making it more secure, more stable etc.
Actually I was giving criticisms of the literal "NT" kernel. But thanks for being here in the future team.
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
and then attempts to refute. Fair enough. Except - the link leads to The Cathedral And The Bazaar - where I cannot find the quote... Hmmm
It's on this page: http://www.catb.org/~esr/writings/cathedral-bazaar/cathedral-bazaar/ar01s04.html
Right after point #8, about halfway down.
Absolutely right. The author seems to be making the argument a lack of pay implies a lack of skill.
From the article:
According to Cowan, who is now a Security Program Manager for Windows, “the scientific conclusion of Sardonix is that auditing is both demanding of high skill and tedious, and so karma/reputation/good will is not enough to motivate people to do it. You must pay them to do it, precisely as Microsoft does.
The author is right that the "many eyeballs" scheme needs skilled eyeballs to work, but assumes that the only way to get good people on a project is by paying them. It seems odd that an article that tries so hard to provide a compelling argument makes such a poorly backed assumption. It's certainly true that good people need to be payed, but they can be paid to work on free software or write free software in their spare time; both cases have many examples.
So if this is the future...where's my jet pack?
...A perfect program that is never written isn't very useful.
It is, however, bug-free!
0. People being paid by big companies like HP, Red Hat, and Novell to fix Linux bugs.
I feel the need to explicitly call this guy a shill, rather than imply it. IF he honestly believes what he wrote, he's merely an idiot.
Shawn Hernan has deliberately misconstrued what Raymond wrote. Raymond explicitly said that the phrase "Given enough eyeballs, all bugs are shallow" was an informal phrasing of the lesson, in the very first sentence of the lesson. The actual phrasing was given as "Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix obvious to someone." There's not even one sentence separating the two.
Trying to rip apart an informal phrasing, and ascribing hidden syllogisms to it, tells me this man is either an ideologue or an idiot. Given his position, he's a dangerous ideologue or idiot.
If opportunity came disguised as temptation, one knock would be enough.
3^2 * 67^1 * 977^1
Reality unfortunately insists otherwise. We can't blame Microsoft for it but it is still the rule rather than the exception. There are plenty of idiot developers out there that still have the single user MSDOS mindset where security is not seen as a problem because from their viewpoint the user only has a computer so that they can run that developers application and nothing else. "Security" dongles are a major offender and other bits of crapware that insist on running services instead of just running like a normal application. You could run things like that as normal users but developers have admin so they write it so it MUST run admin.
That is more of the cause of the malware plague than Direct-X, old versions of IE and MS Outlook.
Oh yes, remember that a "power user" is an Administrator that just hasn't given themselves full permissions yet but they or the malware they bring in can do that without help.
Some of my points (IMHO, my 2 cents, works for me, etc.):
Mr Web Man: "Safari is way faster than Firefox on OS X and uses less resources."
Me: "Safari doesn't run at all on GNU/Linux or Solaris or FreeBSD. Besides, Firefox has a LOT of features that I like"
Mr Netbook Man: "The Gnome desktop is still kinda clunky, even after all these years."
Me: "I don't know what you mean by Clunky, but I prefer the functionality of Gnome over Windows or OSX any day of the week. Anyway, I like KDE and XFCE more than I like Gnome."
Mr Graphic Designer Man: "Linux still doesn't do proper color management."
Me: "I don't know what that means. You may be right."
Mr Gamer Man: "There aren't any decent games for Linux."
Me: "There are actually some decent games for GNU/Linux, but I agree that the selection could be greater. I hope the situation improves, but gaming is far from my primary concern"
You'll notice that I don't have to mention software freedom.
Lemon curry???
http://marc.info/?l=openssl-dev&m=114651085826293&w=2
And so MD_Update(&m,buf,j); /* purify complains */ was commented out.
I know that was a flippant remark, but step back and look at it.
The statement is an accurate, yet deeply depressing indictment of the modern world. We should be focused on making thing better, not accepting things the way they are.
It is also easier to report open source bugs. I have never reported a bug in a proprietary app, but I have reported lots of Linux bugs (mostly distro level, or fixable at distro level) because I can follow what it happening, and I know what the (usually good) reaction to my individual report is.
Report a closed source bug and you get fobbed off by first line support who know less than you. You have little change of ever talking to someone who understands the problem.
Report a open source bug and you get told why you are wrong, or why they can't be bothered to fix it, or how unreasonable you are for demanding they fix your problems. But if you provide a patch you have a chance of being taken seriously.
It's not exactly easy either way around.
Uhhhh...dude? it is an OS and NOT a religion, okay? Why do you think that MSFT has 90%+ of the market? Hint: it is not a conspiracy, or Ballmer sneaking a money truck up to the back door of every shop in the middle of the night. It is because a good 99.999% of the public don't WANT to know how to change the software they use, could frankly not care less about giving it to their neighbor, and have no chance in hell of improving code.
Those things may be important to MIT hacker types, but the vast majority of the public really couldn't care less. They want pretty, they want simple, they want easy. there is a damned good reason why MSFT and Apple spend the money they do on UIs, it is because the customers want GUIs not shell scripts. Have you even tried OSX? It is really really nice. Windows 7? really nice too and user friendly.
So if you are actually wanting to convert followers to your OS/religion/whatever? hate to be the one to break the news but compromises will have to be made. Things like a stable ABI so drivers (even "non free" ones) can be put on CDs, so that instead of the ass backwards "let the kernel devs do it" you can have little penguins on boxes like the little Apple and Winflag the other guys have. The words 'open up bash and type" will have to DIAF and be the absolute LAST resort, and not the first as it is now. Because as it is now for geeks Linux is okay, for retailers and the public it is a royal PITA which is why they would rather pay good money than have your "free OS".
Because in the end it really ain't gonna make any difference if "more eyes make bugs shallow" or not if you are stuck at 1% forever. It all comes down to giving the public what they want. They want GUIs, they want simple, they want easy. They do NOT want CLI, they do NOT want to learn how to code or write scripts, and they do NOT want to have to research like it is a fricking test just to shop for peripherals at the local Walmart. I honestly think Linux security could be a real help to Joe public if just more time was spent on usability and making things easy instead of yet another text editor or distro.
But to get to that critical mass point I truly believe changes will have to be made so that the Walmarts, the Best Buys, and the mom and pop shops like mine will support you. But we don't drink the "freedom" koolaid, and don't give a crap about having access to the code if our bottom lines are eaten away by after sale support thanks to "open up bash and type" and paperweight roulette. And I apologize for the length, but I truly hate how Linux seems doomed to stay a tiny niche because those that treat it like a religion act like the world will just looove CLI and research and all the other PITA crap if they will just "embrace the freedom". But as the success of iPods and iTunes has shown the public really doesn't care as long as it is easy to use and pretty. The new DEs have the pretty down, at least on the surface, but the ease of use is a hell of a long ways away from OSX and Windows.
ACs don't waste your time replying, your posts are never seen by me.
In my world, the software stands or falls on its own merits. There's plenty of truly excellent FOSS out there, and as I said in a neighboring message, I use some of it daily. There are also areas where the FOSS world has failed to produce anything beyond clunky second-rate knock-offs of proprietary software. And there are areas where proprietary software has built on and then surpassed the FOSS software it's riffing off.
Specifics?
Some of my favorite FOSS stuff -- things I'd pick over the commercial alternatives any day of the week, purely on their own merits: The Linux kernel and GNU command-line utilities. PostgreSQL. The Dojo toolkit. Firefox. Thunderbird. Eclipse. CUPS. Apache (web server, many of their other projects suck). Various Debian package managers. VirtualBox.
Some cheap and clunky and altogether second-rate things that attempt to duplicate functionality of commercial software that does the job much better, that I (hate to but nevertheless) use, for any of a number of reasons: GIMP. OpenOffice (especially the Word and Excel clones -- and good grief, it oughtn't be that hard to do better than *Word,* of all things!) GNOME/KDE/any other Linux desktop. Various RAW conversion utilities.
Some commercial software that does stuff better than the FOSS stuff they're riffing off or building on: Jira. Confluence. Mac OS X.
Some areas where the FOSS world has consistently failed to deliver, despite years and years of effort and constant promise, and the fact that the problems appear ideally suited to being solved the FOSS way:
Content management systems. There are a gazillion FOSS ones out there, and all of them suck in some significant way -- either they're a big ol' mess of vaguely connected utilities (Drupal), they make very big assumptions about how you want your site to work (Joomla), or they're half-finished while incorporating several internally competing ways of doing things (Lenya and its plethora of editors, none of which really work very well.)
Anything related to proper graphic design tasks. This requires a full chain of utilities from the RAW file in the camera to the finished file to be sent to the printer (or put up on the web). Most of the chain just isn't there: no system-wide color management, no RAW conversion software with accurate, consistent profiles for a wide range of cameras, no genuinely functional (and color managed) page layout software.
I could go on, but you get my drift. I don't care for ideological arguments. If FOSS is a genuinely and universally better way to make software, it would have incontrovertibly proved it by now. If it was genuinely and incontrovertibly unworkable, it would have failed by now. Instead, it's done neither -- it works brilliantly for some things, fails miserably in other things, and muddles along for lots of others. Just like any other way of making software.
Whew. I feel better now.
He reports Coverity's results on open source software
... but doesn't report Coverity's results on Microsoft's software.
He reports that Coverity scanned 280 open-source projects
...but doesn't report that only 180 of those have "active developer support".
He can't be bothered to present any data at all on the distribution of the reported or corrected defects — how many are in nethack or aalib or that long-abandoned "flash-based photo album generator"?
He doesn't, for instance, mention that Samba and several others have no defects Coverity can discover. None.
Vim has none. X.org has ... three. All of KDE, nearly five million lines of code, has ... ninety. glibc has none.
There have been MySQL and PostgreSQL and Berkeley DB versions with none. His bioblurb says he's "currently working to ensure that Microsoft SQL Server is secure". That's interesting. You mean it isn't, now? How many defects can Coverity find in SQL Server?
TFA is a nauseating pile of sneers and aspersions ("Hope is not a security strategy"?) built on a very carefully selected and very few facts. "No one is doing auditing" he quotes. "No one is doing auditing" and reporting it to some self-styled central authority almost no one ever heard of is what's true, but telling the truth isn't what he's doing here. He's a "Program Manager", and he works for Microsoft.
As always, all IMO. Insert "I think" everywhere grammatically possible.
Creating and then enforcing standards and policies with respect
to source code and development process is not going to help if the whole thing is broken as
designed.
I was thinking of the irony of an MS project manager lecturing the Linux kernel devs on "bugginess."
Put identity in the browser.
This argument is logical, and reasonable.....but for all that is wrong
Linux is (surprisingly) not riddled with bugs, not full of security holes, and is maintained
Microsoft products (surprisingly) do have security holes, do have bugs, and these are left unpatched until people complain ...
The problem is that in general people who use Linux complain about the flaws, and if the people who manage the code agree it is a flaw, then it does get fixed, the only cost is time .... with Microsoft fixing/not fixing each flaw is evaluated as to the cost in money and time
Linux people use Linux and so have an incentive to make it work (at least how they want it to) Microsoft only need to keep selling, so it has to be "good enough", people have noticed that internet explorer development ground to a halt when there was little or no competition and picked up again when people started using other browsers ....
Puteulanus fenestra mortis
To be fair to Microsoft this is no longer true. UAC asks the user if they wish to elevates privileges when an app does something unsafe. Vista took a lot of flak when UAC appeared (including from myself) but it did force user land applications to stop abusing the registry (e.g opening HKLM with read/write permissions), writing random files to random locations on disk and other unnecessary operations. The consequence is apps written / patched in the last 3 years run pretty cleanly and if they don't, you get the UAC popup. In practice it's little different from what happens in Ubuntu or OS X in similar circumstances.
I defend the hypothesis that the two major crises that afflict the computer industry (unreliability and low productivity) are due to our having adopted the Turing Machine as the de facto computing model in the last century
You're hypothesis fails by being based on false assumptions. The Von Neumann architecture has been the de facto computing model, not the Turing Machine. Turing Machines suck at IO.
Furthermore you don't seem to understand that the reason computer programs are, as you call them, unreliable and low productivity, is mainly because programming is hard, and most of the time this has nothing to do with threads. Have you ever spent hours trying to get elements to line up perfectly on a web page in three different browsers? It is a problem that makes you want to pull your hair out, and yet it doesn't matter whether you are running with threads or with double-buffers, the problem will still be there. Programming is hard because controlling a computer is hard.
The boomers were wildly successful but this is a new age, the age of massive parallelism and super complex programs. The boomers need to retire and pass the baton to a new generation of computists. Sorry but that's the way I see it.
What the hell? When did this become a generational war?
Qxe4
I learned something about "Group intelligence" from the quiz show Who Wants to be a Millionaire in which contestants are given three lifelines to help them answer difficult questions.
The weakest lifeline by far is to appeal to the wisdom of the crowd and ask the audience. This only works for the simplest question.
Phone a friend works better IF you know the right friend.
However the most powerful lifeline. The one smart players keep till last is 50:50 - randomly removing two wrong answers.
So if open source debugging is equivalent to "Ask the Audience" then closed source debugging by the specialised team of developers is "Phone a Friend". Now all we have to do is figure out what is the debugging equivalent of 50:50 and all our problems are solved.
An unpaid developer works on stuff that is interesting to him. A paid developer works on stuff that is interesting to his manager.
If I'm working for MS and I notice a certain feature is a bit buggy, I might want to take a look and fix those bugs. But there is a deadline and the marketing department want a certain feature added so they can put another checkbox on their next ad. So the bugs don't get fixed.
But if I'm working on an open source project and I notice a feature is a bit buggy I can go ahead and fix it because my manager isn't breathing down my neck to add some other feature.
I'm working for a company that uses MS products. My manager notices a feature is buggy. I report it to MS and.... nothing happens. So I find work arounds and show the other people at my company how to make the feature work despite the bugginess.
I'm working at a company that uses open source products. My manager notices a feature is buggy. I report it, and if the manager is still breathing down my neck, I find the bad code, fix it, send a patch to the project maintainers.
MS's priority is to add features to make their software more marketable. Open source software's priorities are whatever is important to each developer working on it. That may mean adding more features (like MS) or making the features more robust (unlike MS).
Mr Graphic Designer Man: "Linux still doesn't do proper color management." Mr FOSS Man: "Writing unfree software is immoral!"
You can have more than decent color management on Linux and/or with FOSS software, actually. I bought a cheap calibration hardware that comes in Pro and non-Pro variants. I opted for non-Pro. The difference between the two is software. With ArgyllCMS, you can actually get better results using the non-Pro device than with whatever software comes with the Pro version. And that's without any compiling or patching or any kind of fiddling most 'normal' graphic designers find too difficult to even attempt. Not just that. Should I get a new device (at least one of the well-known brands), it would most likely work with the same software without any need for a change in work flow.
So, while I would maintain that it's not quite right to write software that you cannot share with your friends or modify if you know how, I would also like to point out how many anti-open-source arguments like the one above have been obsoleted by maturing open-source projects.
Every harsh word you utter has the right address. It only sounds harsh because the one on the envelope is the wrong one.
we must point out that freedom is our primary concern
It might be yours, but when it comes to choosing software getting the job done cost effectively is mine. If the closed source commercial software will do the job and the FOSS won't then I'll choose the closed source commercial, thanks. It's not an automatic choice. Some FOSS is better than the closed source commercial, but some is complete rubbish, and in the latter case I couldn't give a monkeys about the "freedom" it gives me.
Quidnam Latine loqui modo coepi?
Plan9 is in the Unix family, one secuirty alert in 15 years
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Bugs are an error in the process, not the code. If you find a bug, you need to find the process error that allowed that bug to occur.
Not in the code?
Of course bugs are errors in the code. Duh! And sure, bugs may be errors in the process as well.
But why the false antithesis?
-wb-
You get it exactly and word it perfectly.
Linux IS its freedom, without it, it wouldn't be the same and might not even exist.
One of the most beautiful things I find about GNU/Linux is that I can get a working development AND/OR server environment all from a single package manager. That is because all the software is free, no endless license agreements to click through or setup programs that try to install all kinds of crap or require me to register. Just apt-get/pacman/emerge.
To me windows is the OS that never fails to have a major hickup. Silly stuff like suddenly deciding I got duplicate ethernet cards or freezing completely on a copy and don't even get me started on the long work of visiting every website for all the various apps that I use, downloading them manually, then installing them, clicking through all the decisions, organising them efficiently (why does everything go in the main menu?).
OSX is little better although its setup is easier you still got to go hunting yourself. And don't even get me started on when you want to configure basic things like the END and HOME key to behave as you would expect them. And neither OS has focus under mouse, a basic feature that linux/unix gui's have gotten right for decades.
But all of that exists, because of the vision of a free set of tools Stallman had. Same as there are still whales swimming thanks to the "extreme" views of Greenpeace. Sure sure, you might to want to wear fur, but then you can't have whales.
I think it is sad that having principles is today considered extreme. People who say opensource freedom don't matter say that because they don't vote, democracy does not matter. You might be right, if you ever been in a place like China (and there are far worse places to be as a westerner) then you might have a hard time figuring out why dictatorship is so bad, everything works and crime is low.
A paradise surely? Yup, right up to the point that it is YOU they are coming after.
We recently have had two stories about software products being bought and their future being in doubt. MySQL now being owned by Oracle, and its future is fairly safe because GPL is hard to kill off. But what about FAST search now owned by MS? Oops its unix/linux support is gone just like that and screw anyone who depends on it, no way out for them.
Freedom, it doesn't matter until you no longer have it.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
UAC was created to fix a problem that was there before by a design problem. If there was no problem UAC would not have been needed.
Sorry, that's totally wrong. The Airbus FBW systems do allow reversion back to "just do what the damn human says". However, in the situation that aircraft was in, if it were a 1972 manufactured Boeing 747 with the same fault (no airspeed indication, inside a storm, in a flight regime where stall speed and maximum mach number are very close together) it is likely that the end result would have been the same.
Incidentally, how the A320 allows human handling of exception was very well demonstrated by the United flight that ended up in the Hudson - in which no lives were lost despite a very difficult situation.
Oolite: Elite-like game. For Mac, Linux and Windows
I think the matter that people get paid, nor that most of those working on the same area are from the same company will help in making Linus's Law 'more true'.
Yes, in general, the more people look at an issue, the more likely it is that someone will spot a bug, if there is one.
But - I give you the following caveats to this:
* people working closely together might reduce design flaws, but not necessarily implementation flaws - knowing specifically what a piece of code is doing CAN stand in your way of spotting subtle bugs in it (because the code more or less reads like what you expect). So, it helps to have more 'independent' pairs of eyeballs looking at the code.
* people not knowing the subject matter inside out are not on par with people who do. People who know how buffer overruns come about may figure out potential buffer overruns more likely than others. On the other hand, if, say, these people were to look at encryption code, they may see a potential for a buffer overrun, but not necessarily, whether the implementation of the encryption routines has a (not totally obvious) security flaw in the way it handles its keys; or whether any s-boxes may be good or not.
So, the more 'subject-matter-aware' eyeballs, which work independently of each other, look at a given code, the more likely you are getting a better review of the code.
I don't think I'm a bad C developer, but I don't think I could spot the majority of the linux kernel flaws because I do not know enough of the design of the kernel and potential interaction of areas of code.
Mr Graphic Designer Man: "Linux still doesn't do proper color management."
Me: "I don't know what that means. You may be right."
Funny that you mention that; I've throughly compared several CMS engines, from Adobe, Apple, Esko (formerly Barco), Efi (makers of the Fiery) and LittleCMS (the OS CMS used everywhere Linux need color management). Believe it or not, LCMS was right there with Efi on quality, a little better than Adobe, and waaay better than Esko (Apple was erratic, it seems to be a modification of Efi's engine). And it ran circles around everything else on terms of performance and resource utilization.
So, quality _can_ be better on OSS, but it won't dispel long help myths.
-Kz-
Even further than that, this article in the New York Times argues that it was only because of the FBW system in the A320 that the miracle on the Hudson was even possible. The author argues it wasn't just human intervention but computer assisted human intervention that allowed all those people to escape.
I had a dream, bright and carefree, but now there's doubt and gravity
Microsoft has 90% of the market because of what they did in the late 80s and though the 90s that resulted in them becoming a convicted criminal monopolist. Please read up on that era and watch how those things play into how software development is so complex that once you commit to one you will almost never put the resources into any other, even though they may be viable. Software today is not a democracy. It is a dictatorship. OSS is the only free choice you have. That's not an extreme view, that's the reality of developers, developers, developers.
You can lead a man with reason but you can't make him think.
Well the catch is that linux developers are mostly being paid. That's IMO what's taken say pre ubuntu linux from being an amusing nerd gimmick to something a normal human being might actually use for something. Firefox developers are being paid too.
If you pay people to do the wrong things the product will suck. Linux benefits from several eyes on the problem of deciding where development money should go. But that's the same weakness. What happens to firefox when the product they sell: A google startpage, is usurped by google launching its own competing browser (or if their privacy ideals conflict with what google does to that search info)?
The quality of software is judged by it doing what you want it to do, whether you want it to do the right or sensible thing or not is another matter. IE was cheap (i.e. free), and preinstalled, netscape wasn't. Since then they worked hard to maintain backwards compatibility with a product who's main selling feature was that I didn't have to download it. Which is why they have more marketshare than firefox still. Vista was competing with XP, not Linux. And it offered no real compelling reason to upgrade, on the other hand most of the core software stuff in Vista carried over to 7, which is apparently wonderful, even though it's main difference from vista seems to be they changed the priorities on some processes, changed the look of the skin and put a big 7 on the box.
Where are the results of those paid developers you ask? http://www.computerworld.com/s/article/9142978/Windows_market_share_slide_resumes down to 92% of the OS market. Office went from what, 10, 15% of the market in 90/91 to probably 80% today, and I bet 90% of the revenue. The market of people who pay for the product they use seems to have spoken. MS fulfills their requirements. Just because their requirements may make no rational sense, they paid people to do what the customer wanted - and the customer got a product he/she will pay for.
Linux developers obviously haven't put enough effort into making the product people want. It may, in the formal proof sense of computer science be 'better', but it obviously doesn't meet as many user requirements on the desktop.
As for who produces the best quality, the passionate volunteer or the guy in it for the money? Well how long is the project? If my developers aren't getting paid, what are they eating, where are they living? If they're getting paid, but not by me, how much work can I expect them to actually do? The guy guaranteed a job no matter how terrible a job he does (Yugo), in the socialist/communist system doesn't really count.
You realize software isn't free right? Duplication costs being nothing isn't he same as the product costing nothing to make. A fighter jet costs 40 billion dollars to develop, and 100 million dollars to actually manufacture. If you only sell 100 of them (say the french Rafale) 80% of your total costs (50 billion) are in 'development' and 20% in actual production. Or maybe it will be 40/60 if they make a full 200 of them, whatever. The passionate volunteer who really really wants to do it still needs to eat, so if you want him to stay on time and a budget you kinda need to pay him. Or else he's going to work for the person who offers him food, and not work on your project.
Why do you think that MSFT has 90%+ of the market?
They don't. There's a whole world of computing out there beyond laptops and desktops. When it comes to embedded and server devices, Linux is kicking ass.
The majority of the population want pretty pictures controlling their computers, there's no doubting that. Aside from basic office apps, the PS3 could probably handle most of their needs (web browser, movies, pictures).
But when you want power, a GUI can't cut it. Sometimes you need to see the guts. And that's when Linux shines. It's not for 90% of the population. It's the perfect tool for devs and admins.
If some company wanted to put forth the effort, they could probably put together a decent Linux UI that was easy to use for your average consumer. And they have. People use Linux more often than they know - in their cameras and cell phones and assorted other gadgets. The UI is so prominent that without special tools it's *impossible* to "open up bash and type...".
Last post!
Note to self: Microsoft evangelists no jack-shit about Linux.
I have had few problems installing the latest versions of Ubuntu on my rather annoyingly difficult HP notebook with its goofy Broadcom drivers. By the same token, I have spent the better part of an hour trying to find appropriate drivers for similar notebooks (and don't get me started on when HP's universal print driver goes kersplonk).
This idea that somehow Windows is this insanely excellent platform, and that all the software for it is easy to use is just a load of crap. What I notice about most Windows-only admins is that they frankly don't know jack-shit about computers beyond this very limited ecosystem. They have no malleability, no adaptability, no capacity to ignore the boot up logo and deal with problems and come up with reasonable solutions.
I'm not any kind of zealot. I'm a guy who has worked with everything from old DOS 3.3 systems running LANTastic and Xenix servers to Server 2008 and VMWare, and the one thing I like to think is that I can learn new systems with relative ease, and can offer my boss or my customers solutions that fit their needs and their budgets. If they have the budget for Microsoft servers and CALs then that's fine, but these days I'm getting people asking me questions like "How can we get away from large licensing budgets".
I charge $50 an hour for my time, minimum. I guess that's what the extra $25 gets you, someone who isn't just a Microsoft drone who can't even use dpkg to install a driver.
The world's burning. Moped Jesus spotted on I50. Details at 11.
What do you mean by unmaintainable? How can it be unmaintainable, yet still be in use to this day?
You can use something that's unmaintainable. All "maintenance" is, in this context, is applying the necessary fixes to keep the OS reasonably current and secure. Every product, sooner or later, reaches a point where it's "not economically feasible" to continue making proper repairs-- you just wind-up spending too much money and time doing so.
Maintainability of --anything-- begins with good documentation and an engineering framework that allows for repairs of whatever is broken or functionality upgrades without breaking other things. Since well-documented APIs that say what they do and do what they say are still something I'd assume are lacking in Windows 7 based on complaints of software and drivers not working correctly on it, it would seem that this fundamental flaw in building a foundation for the OS is indeed still present.