I don't think the authors get paid either. So, no pay to authors nor reviewers. Does the editorial board get paid? Perhaps not.
> > That process costs money because it takes people and time to do it well. Journal subscriptions are often not enough to recover those costs.
Some of the items left to consider here are actually putting together the reviewed papers and publishing them. I would say the cost of these two items has gone down with the extended use of computers over the last 3 decades.
What other items are left? It would be interesting to know.
It would be nice if everybody would publish code for their papers. But in a field where most people don't do it, releasing your code will probably not be beneficial for you due to the loss of the competitive advantage. I know for people with cs background this sounds weird but it is reality n academia.
In your position, I would only release code which is not too hard to reproduce anyway or which only provides negligible competitive advantage for you.
I mainly have "normal" paper in mind (experiments or data analysis) - if the main contribution is, for example, an algorithm which you want people to use, the you should publish an implementation obviously.
Tell you friend to watch What the Health [1]. Sure, it provides a somewhat biased view on the topic of eating too much meat, but it is thought provoking anyway.
Based on what's in the linked wikipedia article I'm doubtful this would actually do less harm than good, all while causing him to question my judgement.
If you don't actually audit the hundreds of thousands or millions of lines of code comprising an open source application stack you don't have a guarantee of what's happening either.
Bugs like Heartbleed demonstrate that massive vulnerabilities can be introduced and persist in well-regarded open-source codebases for long periods of time without detection in spite of theoretical "millions of eyes". Heartbleed was, to the best of our understanding, the result of an honest mistake. What's to say that any significant OSS codebase with thousands of committers doesn't have a substantial number of subtle and less-than-honest "mistakes" of a similar character?
In proprietary software it's different. Proprietary software is less vulnerable to infusions of backdoors from untrusted sources and side channels. Proprietary software can only be audited by the developers themselves, and it will depend on the kinds of resources the developers can bring to bear directly. Companies that can afford it can dedicate large teams to reviewing and testing their codebases.
That open source code can be audited by third parties is only relevant if it actually happens, and otherwise you have only a false sense of security.
