On Fri, Apr 21, 2006 at 01:33:55PM -0700, Philip Brown wrote: > > The way forward for OpenSolaris is > > the exact opposite - eventually, there will be no distinction at all > > between Sun and not-Sun with respect to development of the open > > codebases. > > That's terrible, and I hope that either you are misstating things, or > someone wakes up and smells the burning coffee. > One of the BAD things about the open source dynamic with linux, in > comparison, is that there is a whole bunch of badly badly written code in > there, because there isnt enough oversight for who submits what into the > tree.
You're making the same assumption that Dennis made earlier in this discussion: that trusting a person works better than trusting the code. No one is suggesting that the review processes be weakened. But we do not want to be in the business of deciding *whom* we should trust, whether the mechanism is a Sun badge or a callback to the person's supposed employer. Instead, the review processes need to be sufficiently robust that bad code should be rejected whether it comes from a highly respected Sun engineer who made an honest mistake or an unknown Romanian teenager trying to sneak in a back door. Again, doing away with the aggregation of contributor-produced binary packages in favour of a central source repository as the point of control makes this approach possible. So I'd like to rephrase your assessment: [The problem with Linux's development process is that] there isn't enough oversight for _what_ goes into the tree. And certainly that's true: maintainers can be arbitrarily lax, and subsequent levels of review may or may not take place; there's no way to track who has reviewed what, and in any case the standards are inconsistent across the codebase. The 'Signed-Off-By:' step they've added isn't especially strong, but applying it to code review as well as provenance would be a great start. I believe the process we have is far more consistent, and will be much better still once code review itself becomes an open process. If you don't believe the development process outlined at http://www.opensolaris.org/os/community/onnv/os_dev_process/ will be robust in the face of malice and/or inadequacy on the part of contributors, we'd like to know why. If OTOH you want to argue for trusting people instead of code, you have an uphill battle to fight; that policy is antithetical to all historical and current Solaris development ideology. -- Keith M Wesolowski "Sir, we're surrounded!" Solaris Kernel Team "Excellent; we can attack in any direction!"
