Raymond’s finite-code argument doesn’t get us around this. Even if we freeze a codebase and grant that its defects are finite, that doesn’t mean today’s tools can find them all, much less prove they have. Oh, and P.S.: We don’t freeze production software. Not really. We change code, upgrade dependencies, and connect systems their original developers never expected to meet. Our optimistic commenter on Raymond’s post acknowledged that bugs will remain in interactions between systems and their complex behaviors. That’s quite an exception. Massive, even. For an enterprise, those interactions are much of the software it actually depends on.
None of this makes the fixes worthless. Mozilla said all 22 security vulnerabilities were fixed by publication, helped by reports with small, reproducible test cases. We can become more secure without arriving at some permanent state of security. But someone still had to validate the findings and get repairs into software people could use. That’s where the open source argument gets stronger. Better tools will keep finding things we missed. A shared project lets us carry the fixes forward together, rather than each company paying to rediscover and repair the same problems in its own private version.
Readable software is just the start
There’s a related argument that AI-assisted reverse engineering makes source access irrelevant. That is, if a machine can reconstruct useful code from a binary, haven’t we effectively made everything open source? Well, no. Software running on someone else’s servers doesn’t necessarily give you a binary to inspect. And a plausible reconstruction isn’t automatically a faithful one. A September research preprint found that some LLM-decompiled functions passed the supplied tests while behaving differently on other legitimate inputs. Clean-looking code and the original program aren’t necessarily the same thing.
robot-eyeballs-make-open-source-more-valuable