Of course it's "anecdata" because I've never personally conducted a test of all security consultants for their programming skills. But the people you tell abou

Of course it's "anecdata" because I've never personally conducted a test of all security consultants for their programming skills. But the people you tell about (developers who specialized in security) maybe exist in large shops (Google, MS, FB), but many, many security consultants will work for specialized firms that offer security services, but not software development, and vice versa. Take a look at most Defcon/BlackHat talks where a vuln is explained/uncovered/exploited: most such researchers don't pertain to a software development firm, but to independent security firms. Why should my assessment not be useful? I proposed a very clear solution to what is the problem. Source: I worked for almost ~10 years in a firm who had both a software development and a security services branch, met tens of security consultants and worked in remediation activities for software issues where the security consultants weren't able to do it. EDIT: about the kernel code, I agree with you that such code is a step in the right direction, but I agree with Linus that the "warn" should come before the "kill".