I never understood the vitriol, because he could have just said they weren't up to spec. And when people don't fix bugs, just suspend taking their patches and s

I never understood the vitriol, because he could have just said they weren't up to spec. And when people don't fix bugs, just suspend taking their patches and say that. In the case of PaX, there is definitely a conflict between the later commercial concept (pay to receive these patches to a GPL2 product) and the integration of security features in a comprehensible way in mainline. Brad Spengler is right that big corporations use his work for no recompense (gotta love the cancer that is Oracle), but tbh many of the patches are hard to grok. And Linus had a ridiculous 'security bugs are just bugs' attitude, opposed to the additional complexity added in some patches. I think many of the mitigation techniques are painful and have ramifications on many other areas -- but the larger redesign just wasn't being done. And they are both ascerbic individuals. I thought his rants directed at Kees Cook were worse. He is allowed to reject everything insufficiently tested, so why doesn't he just do that? Anyway, Kees was a model of restraint.