Re: OpenSSL development (Heartbleed)

["Randy Brukardt" <randy@rrsoftware.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2823 bytes --]

"Georg Bauhaus" <rm-host.bauhaus@maps.futureapps.de> wrote in message 
news:5352a585$0$6707$9b4e6d93@newsspool3.arcor-online.net...
> On 19/04/14 18:00, Yannick Duchêne (Hibou57) wrote:
...
>> However you are more likely to get people sticking to good methods, give 
>> time and energy for this, if they get something in return.
>
> Well, that again makes for a hypothesis that is so unspecific
> that it fits the same bill: correlation turned causal based on
> likelihood, ceteris paribus.
> E.g., what are the specifics in terms of work hours, pay, and
> project characteristics? Do we have control-group like evidence?

I can give you a couple of data points:

First, the state of Ada standardization when I was funded to do 
administrative tasks. Before I took over, the ARG had a succession of 
volunteer editors. Toward the end, the only thing produced was meeting 
minutes. No one had organized the suggested changes, or figured out the 
effect on the standard (in some cases, the suggested changes were impossible 
to fit into the standard and we ended up coming up with completely different 
resolutions).

Once I took over, I spent a lot of time on that sort of administrative 
tasks, and in other things that improved the process, like having on-line 
access to version control for documents (prior to my taking over there was 
no version control and on-line access was only to the most recent posted 
version of a document - which often was well behind the current state). This 
work was (and is) not much fun, and I think only someone who was getting 
paid would do it for long. (I'll have been doing it 16 years this fall. 
Wow.)

The second example is the ACATS. Here, I took over directly from another 
paid person (Dan Lehman at the AVO). So I needed to make few changes to the 
basic procedures or approaches; mainly I wrote down a lot of the procedures 
that hadn't been well-documented in the past, and added a few new ones to 
deal with public version control and a finer-grained and more formal 
approach to correcting tests and issuing new tests.

In both cases, I think that having a paid person involved has ensured 
quality that otherwise would not have happened. Working with volunteers is 
often described as herding cats (because one can make little assumptions 
about deadlines or quality of work - even in a group as knowledgeable and 
committed as the ARG - one learns who can be trusted to do work on time, who 
will wait to the last minute, and who probably will never produce anything). 
Someone who can put the pieces together and is empowered to do that is 
critical - and that person has to have a way to eat on jobs that will take 
months.

[Of course, my opinion here may be more than a little biased, so please draw 
your own conclusions.]

                               Randy.