Slashdot Mirror
450 Million Lines of Code Can't Be Wrong: How Open Source Stacks Up
An anonymous reader writes "A new report details the analysis of more than 450 million lines of software through the Coverity Scan service, which began as the largest public-private sector research project focused on open source software integrity, and was initiated between Coverity and the U.S. Department of Homeland Security in 2006. Code quality for open source software continues to mirror that of proprietary software — and both continue to surpass the industry standard for software quality. Defect density (defects per 1,000 lines of software code) is a commonly used measurement for software quality. The analysis found an average defect density of .69 for open source software projects, and an average defect density of .68 for proprietary code."
"450 Million Lines of Code Can't Be Wrong"
should have been
"450 Million Lines of Code Can't ALL Be Wrong"
Just ask apk!
Propietary defects are ones that may cause financial harm. FOSS defects are ones that cause annoyance.
I know that our code has more defects than we'd consider fixing purely because the CBA isn't there.
the very definition of 'proprietary software' indicates you dont have access to the code to calculate defect density, and even if you did you cannot independently verify the code you have is production code. how did the researchers quantify it?
Good people go to bed earlier.
"Code quality for open source software continues to mirror that of proprietary software — and both continue to surpass the industry standard for software quality."
What is this third kind of software that is neither open source nor proprietary which is bringing down the average industry standard for software quality? Because if there is only open source and proprietary then they can't both be better than average. Or perhaps the programmers are from Lake Wobegon?
Errors per lines of code may give you a hard number, but that number has nothing to do with the quality of code. It only takes one well-placed error to ruin a piece of software.
Actually, this study does not say anything directly about code quality, because Density = Total Defects Found / Code Size. The problem is with the "Total Defects Found" part. How they are found and how they are reported may differ vastly from one project/company to other. The report sais that the quality of code increases with larger codebases in propertiary projects. In fact, the best you can say is that the metric decreases with larger codebases in propertiary projects. Maybe many of the defects have not been found yet in propertiary projects. Maybe they have less manpower to seek the errors, maybe they just don't care as long anything does not crash. But smaller defects may be in the code. Open source code is more open to "finding the defects", thus possibly obtaining worse "quality" they are talking about in the article. I think this has to be kept in mind when reading the report.
Everyone knows OSS doesn't have defects, it just develops random features
Quality metrics can have unexpected side effects.
"No matter where you go, there you are." -- Buckaroo Banzai
FTA:
The article gives numbers: above 1M LOC, defect density increases for open source projects, and decreases for proprietary projects.
Increasing defect density with size is plausible: beyond a certain size, the code base becomes intractable.
Decreasing defect density with size is harder to understand: why should the quality fairy only visit specially big proprietary projects?
Perhaps the way those proprietary projects get into the MLOC range in the first place is with huge tracts of boilerplate, duplicated code, or machine-generated code.
That would inflate up the denominator in the defects/KLOC ratio.
But then that calls the whole defects/KLOC metric into question.
In open source, a defect gets fixed when someone feels the urge to fix it. Most of the time it is because it is their own dog food. Many open source projects are actually used by their own developers and they fix the issues that irritate them most. And rest of the bugs are based on impact on other users and passion about the software project
In a closed source project, it is often the bugs that affect the loudest paying customer gets fixed. If it is not going to advance sales, it wont get fixed.
Given this dynamic it is not at all surprising both methods have similar levels of that elusive "quality". I think software development should eventually follow the model of academic research. There is scientific research done by the universities that have no immediate application or exploitation potentials. The tenured academic professors teach courses and do research on such topics. Then as the commercialization potential gets understood, it starts going towards sponsored projects and eventually it goes into commercial R&D and product development.
Similarly we could envision people who teach programming languages to college maintaining open source projects. The students develop features and fix bugs for course credit. As the project matures, it might go commercial or might stay open source or it could become a fork. The professors who maintain such OSS projects should get similar bragging rights and prestige like professors who publish academic research on language families or bird migration or the nature of urban planning in ancient Rome.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Sure makes the emacs vs vi wars look petty. This is a religious dispute between the believers in greedy capitalism, who think such forces lead to the best balance of highest possible quality at reasonable expense, in all endeavors, and everyone else.
The greedy capitalists think that if you aren't sweating and stressing over your job and the money it provides to feed your hungry children, not to mention your house and car payments, fearing that the loss of your job will ruin your career so that you will never be able to find another, then you aren't motivated enough to really help a capitalist endeavor succeed. They pressure you to put yourself on the hook with none too subtle hints, couched in plausibly deniable talk of "team spirit" and "dedication" and "commitment". The coworker who buys a new car gets all kinds of praise for, in essence, being such a good wage slave/capitalist consumer. If that doesn't do the trick, managers reveal a few personal details about their choices in housing and transportation, to set an example, and encourage a little bit of "keeping up with the Joneses" envy. If that still doesn't work, they remove the people who aren't falling for it, as those sort set a bad example. Makes for a good object lesson for the survivors of the layoff. Extreme balances on credit cards, massive house payments, and other such horrible burdens become, in this whacked out world, bragging rights. The savvy worker therefore has to appear to toe the party line, while carefully holding back in ways that do not show, because sometimes one ends up stuck under a boss who doesn't know when to quit pushing, and the only healthy alternative the worker has is to leave.
Naturally, they're afraid of open source, readily equating it with Socialism and even (gasp!) Communism, which they have feared for decades. They don't understand the motivations behind open source, and therefore don't trust it. They've been told that open source fits just fine with capitalism (and it does!), but they can't believe that. I think that attitude more than anything, this dogmatic belief in the holiness of wealth and ownership, has propped the likes of Microsoft up beyond all reasonable objective assessment of the true value of their offerings.
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"