Idiots...
Seriously. What are you trying to say?
Kristov did a code review. He highlighted some issues, he pointed them out and Evan fixed the vast majority.
This guy found something Kristov missed. He tried to exploit it, but the whole thing can be seen on the network. Within a relatively short period of time, he was spotted. 24hrs later a patch is applied around the network.
He has identified one exploit. It was closed. It won't be exploited again. It could also highlight other areas that are related that could be worked on. The guy said he was going to donate his winnings.
The project is stronger than it was two days ago. This is a small win.
Plus, I want to emphasize this again, it's irrational to expect one set of eyes to discover every conceivable bug or exploit that might be contained in thousands of lines of code.
If it were that easy to avoid vulnerabilities + bugs by just doing a code review, every single piece of software would be ok with a code review by one man - and nothing else would ever be needed. It would attain bulletproof status from that review alone. But this is not reality, this is fantasy. That's why operating systems go out and they are being patched for years and years for their minor and major bugs. It's not like the code hasn't been checked internally. It's just that there are a lot of stuff happening that can be overlooked. Linux's bash shell was bugged and nobody realized it for a veeeery long time.
Multiple sets of eyes are always better and that's why OS is better (plus it's trustless, as you don't have to trust the dev that he has put something in there that is weird). And yet, even a large number of people looking at the code can't ensure safety right away - it takes time. Take the Monero overflow bug that was executed a few weeks ago that nobody saw coming. Monero has a lot of devs, it has hired cryptographers and experts to review the code, yet it happened. And after BCX threatened to kill the coin, a lot of brainstorming took place on what could be another possible exploit and some things like anonymity vulnerabilities under certain scenarios also came up through the brainstorming process.
