I sort of agree, but I think fundamentally Linus is right to marginalize most infosec people. The vast majority of people in infosec can't see the forest for t

I sort of agree, but I think fundamentally Linus is right to marginalize most infosec people. The vast majority of people in infosec can't see the forest for the trees, and do active harm to both usability/performance and to security by implementing security controls that are such impediments to getting anything done that people just go around them. A security control or system that nobody uses does nothing for security. The basic mentality is "you secure things by blocking things and making them harder to access." No. This is wrong. You secure them by making them secure. A firewall with no open ports is not impressive. What's impressive is a system that does a lot and has many things open to the world and is secure. Security achievement should be measured not in an absolute sense of invulnerability -- as this is impractical -- but as the ratio of surface area to vulnerabilities. If you have no surface area exposed you've accomplished nothing; any system can be secured by turning it off. The more surface area you can safely expose, the more secure your system is and the more impressive an achievement it is from an infosec perspective. There are some great minds in infosec who think this way but they are few and far between. Most infosec people just like to block stuff and make it harder to use.