4 ms·
> Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priorit
by cesarb 3y ago
> Honestly one of the craziest things is Linus saying security vulnerabilities are just normal bugs, don't deserve special treatment or to be fixed with priority, nor should they even be announced.
His position is more nuanced than that. For a full set of relevant quotes, see https://yarchive.net/comp/linux/security_bugs.html https://yarchive.net/comp/linux/security_bugs.html
For instance, this quote seems particularly relevant to this article:
"
[...]
In fact, all the boring normal bugs are _way_ more important, just because
there's a lot more of them. I don't think some spectacular security hole
should be glorified or cared about as being any more "special" than a
random spectacular crash due to bad locking.
[...]
To me, security is important. But it's no less important than everything
*else* that is also important!
Linus
"
- plasticeagle 3y ago"To me, security is important. But it's no less important than everything else that is also important!" I think this should go down in history as one of the most meaningless statements ever made.
- dijit 3y agosoftware that doesn't function at all is 100% secure and has other consequences too. Thus, is it more or less important that the software functions or that it is free of all security issues? If there was a condition that your UI became a different shade of grey in your web browser: you wouldnt buy a domain, create a catchy name, generate a logo and scream from the rooftops. He is just saying: there are important security bugs, there are important functional bugs- they are equally important. Insignificant security bugs are not more important than deadlocks; which if you were depending on the kernel for a life critical system could kill you.
- senectus1 3y agough, if everything is top priority then nothing is top priority.