There will be a large number of people who don't like this. However, consider the following: most people, even those who use linux, don't want to bother with t

There will be a large number of people who don't like this. However, consider the following: most people, even those who use linux, don't want to bother with too much configuration. For those people, it is probably "good policy" to disable a potential security risk. Leave the option for those who understand what they are doing and wish to go ahead, by all means, but make the default secure. For instance, I have server machines at home which do not handle critical or particularly sensitive data. They are securely firewalled, and shouldn't be touched by anything not trusted by me. On those machines, I sacrifice some potential security for performance. No patches for meltdown, spectre, foreshadow, l1tf, etc. as they have significant impacts on performance and these boxes don't really need it. For my firewall, however, I turn on all patches and sacrifice quite a bit of performance (in other areas, not just patches which cause slow-downs) for more security. It handles un-trusted input; other boxes do not. I can plan accordingly. The important thing to remember is that I am intentionally making those choices and considering that trade-off. Most users are not. It is somewhat better to leave things like ASLR enabled and hyperthreading disabled by default, because that is what is best for the average user. Lastly, it is of not that if something such as this is disabled and there is a resulting security breach, every one will run around screaming, "Linux is insecure; ahh!" This will happen, even if the user is informed he is supposed to do this for things which need to be secure.