Earlier quoted context omitted.
Raymond's "Cathedral" post is a contender for one of the most overrated pieces of technical writing. "The parts that are interesting are not new, and the parts that are new aren't good". It's justifiably infamous for the now-discredited "Linus's law", about "many eyes making all bugs shallow", but large parts of it are also shoplifted from Brooks and Pike. I think it's remembered fondly mostly because it was an effec…
I feel like security bugs are in a class of their own and need different ways of thinking about them. If you leave aside security bugs, is Linus’ law still invalid? Any reference to any material on this?
It's still not true if you leave security bugs out. It's basically never true except for a thin class of superficial bugs --- the bugs you'd intuitively expect to get diagnosed get diagnosed, but nothing else does.