5 ms·

Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priority,

Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priority, nor should they even be announced. That's a terrible security approach. The article makes good points.

cesarb 3y ago
> Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priority, nor should they even be announced. His position is more nuanced than that. For a full set of relevant quotes, see https://yarchive.net/comp/linux/security_bugs.html https://yarchive.net/comp/linux/security_bugs.html For instance, this quote seems particularly relevant to this article: " [...] In fact, all the boring normal bugs are _way_ more important, just because there's a lot more of them. I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash due to bad locking. [...] To me, security is important. But it's no less important than everything *else* that is also important! Linus "
- plasticeagle 3y ago
  "To me, security is important. But it's no less important than everything else that is also important!" I think this should go down in history as one of the most meaningless statements ever made.
  - dijit 3y ago
    software that doesn't function at all is 100% secure and has other consequences too. Thus, is it more or less important that the software functions or that it is free of all security issues? If there was a condition that your UI became a different shade of grey in your web browser: you wouldnt buy a domain, create a catchy name, generate a logo and scream from the rooftops. He is just saying: there are important security bugs, there are important functional bugs- they are equally important. Insignificant security bugs are not more important than deadlocks; which if you were depending on the kernel for a life critical system could kill you.
- senectus1 3y ago
  ugh, if everything is top priority then nothing is top priority.
Brian_K_White 3y ago
What he's saying could also be worded as all bugs are also security bugs, and there is really nothing about them that makes them special. Yes fix them, like any other bug. You could also say it's simply a separate domain to care about security above all else. That is true in all things. If safety was your top priority when designing a saw, you would not design a saw at all and the world would not have the use of saws. So, for the saw designer, the top priorities mostly have to do with how well it cuts. It's someone's job to think about safety as their main whole job, but it's someone else. I don't see anything so crazy about either of these two concepts.
nradov 3y ago
Anyone who uses the Linux kernel is free to fork the code and fix security vulnerabilities as quickly as they like, or pay a vendor like IBM to do so. That's the beauty of open source. It's completely unreasonable to expect Linus and the other kernel maintainers to focus on security above everything else.
- PrimeMcFly 3y ago
  That's always such a silly argument, IMO. Yes, anyone can fork anything OSS, it doesn't mean anyone is going to, or it's going to make sense to do it. And sure, no one is forcing the maintainers to adopt a different view, but we can judge them for having a bad or incorrect view, and point out issues that arise from that. And maintainers are not being asked to focus on security above all else, just to treat security vulnerabilities like vulnerabilities instead of just bugs.
  - nradov 3y ago
    There's nothing silly about the argument, you're just being unreasonable. Many organizations already fork the code. There is nothing bad or incorrect about the maintainers view, nor are they responsible for issues arising from that view. Use different software if security is critical to you.
    - PrimeMcFly 3y ago
      No, I'm not being unreasonable. And yes, it is a silly argument. It's not a practical solution. It's akin to telling someone without a license who lives 10 miles from their place of work to walk if they are not happy with the bus service. The maintainers view is absolutely incorrect and flawed, ultimately it doesn't matter because distributions pick up their slack.
      - nradov 3y ago
        There's no free lunch. Buy a car if you don't like the bus.

cesarb 3y ago

> Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priority, nor should they even be announced. His position is more nuanced than that. For a full set of relevant quotes, see https://yarchive.net/comp/linux/security_bugs.html https://yarchive.net/comp/linux/security_bugs.html For instance, this quote seems particularly relevant to this article: " [...] In fact, all the boring normal bugs are _way_ more important, just because there's a lot more of them. I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash due to bad locking. [...] To me, security is important. But it's no less important than everything *else* that is also important! Linus "

plasticeagle 3y ago
"To me, security is important. But it's no less important than everything else that is also important!" I think this should go down in history as one of the most meaningless statements ever made.
- dijit 3y ago
  software that doesn't function at all is 100% secure and has other consequences too. Thus, is it more or less important that the software functions or that it is free of all security issues? If there was a condition that your UI became a different shade of grey in your web browser: you wouldnt buy a domain, create a catchy name, generate a logo and scream from the rooftops. He is just saying: there are important security bugs, there are important functional bugs- they are equally important. Insignificant security bugs are not more important than deadlocks; which if you were depending on the kernel for a life critical system could kill you.
senectus1 3y ago
ugh, if everything is top priority then nothing is top priority.

Brian_K_White 3y ago

What he's saying could also be worded as all bugs are also security bugs, and there is really nothing about them that makes them special. Yes fix them, like any other bug. You could also say it's simply a separate domain to care about security above all else. That is true in all things. If safety was your top priority when designing a saw, you would not design a saw at all and the world would not have the use of saws. So, for the saw designer, the top priorities mostly have to do with how well it cuts. It's someone's job to think about safety as their main whole job, but it's someone else. I don't see anything so crazy about either of these two concepts.

nradov 3y ago

Anyone who uses the Linux kernel is free to fork the code and fix security vulnerabilities as quickly as they like, or pay a vendor like IBM to do so. That's the beauty of open source. It's completely unreasonable to expect Linus and the other kernel maintainers to focus on security above everything else.

PrimeMcFly 3y ago
That's always such a silly argument, IMO. Yes, anyone can fork anything OSS, it doesn't mean anyone is going to, or it's going to make sense to do it. And sure, no one is forcing the maintainers to adopt a different view, but we can judge them for having a bad or incorrect view, and point out issues that arise from that. And maintainers are not being asked to focus on security above all else, just to treat security vulnerabilities like vulnerabilities instead of just bugs.
- nradov 3y ago
  There's nothing silly about the argument, you're just being unreasonable. Many organizations already fork the code. There is nothing bad or incorrect about the maintainers view, nor are they responsible for issues arising from that view. Use different software if security is critical to you.
  - PrimeMcFly 3y ago
    No, I'm not being unreasonable. And yes, it is a silly argument. It's not a practical solution. It's akin to telling someone without a license who lives 10 miles from their place of work to walk if they are not happy with the bus service. The maintainers view is absolutely incorrect and flawed, ultimately it doesn't matter because distributions pick up their slack.
    - nradov 3y ago
      There's no free lunch. Buy a car if you don't like the bus.