5 ms·

Linus hates security and security related projects. He is against prioritizing security bugs over normal bugs. Also he is against embargo (coordinated release).

• api 12y ago
  I simultaneously agree and disagree with him. I think he's wrong because security is increasingly critical, but I agree with him because I can't stand (most of) the infosec profession. The vast majority of infosec gives zero thought to any concern other than security, resulting in systems that are insanely complex with incredibly poor user experience. Not only does this break everything else, but it's bad for security in the long run. The typical security solution is something that makes it so hard for people to do ordinary work that they either disable it entirely (e.g. SELinux) or work around it (tunneling through aggressive firewalls, etc.) and defeat the whole purpose. I worked in a research institution once where some departments had people whose informal job description (I was told) was to "help work around security so we can get our work done." If you worked with security, they'd put up so many road blocks and say "no" to so many things that months and months could go by without a single thing being accomplished. There was a whole culture of literally conspiring to ignore and sidestep the security department. People kept doing this even after we got hacked, arguing (again explicitly) that the cost of complying with infosec was greater than the cost of the hack. Infosec is largely a ghetto populated by people who only think about one thing, and who think that one thing is the sexist, coolest, most important thing in the entire world. There are other such ghettoes and they all suffer from similar sorts of problems. I firmly believe that almost nothing can be done well without whole system thinking. You have to look at the entire context of a system, not just the one thing you're building or optimizing. Think about the system from technical details all the way up to how users will interact with it on a day to day basis. A good starting point is to look at whatever you're building and ask "how annoyed would I be if management foisted this on me?" If the answer is "very annoyed," your system has horrible UX. This isn't the only case where I simultaneously agree and disagree with Linus. Another notable one is C vs C++. Short version: I think C++ is fine and makes it a lot easier to do many things, but anyone writing C++ should have YAGNI and KISS tattooed on their forehead. As with many other "powerful" multi-paradigm languages it takes discipline to avoid over-using the language's features, and most programmers unfortunately have the opposite tendency. They over-abstract and over-engineer as if they're trying to show how clever they are.
  • jrapdx3 12y ago
    I wholeheartedly agree with your commentary about such "compartmentalized" approach to systems tasks. The description of narrowmindedness is on target for many domains, certainly I've observed it in medical fields. The problem arises from complexity. We are able to track only so much information at a given time so specialization develops. But as we find out more and more how processes intertwine it calls for having awareness of the generalist point of view as well. It's a difficult feat to accomplish, to hold a meta and detailed view simultaneously. Probably it's a particular talent to be able to do so, but as complexity is not going to decrease, future leaders will need to be talented in this way if the problem is going to be solved.
    • api 12y ago
      To some extent I blame the Silicon Valley cult of recent grads, where "25 is the new 55" as someone once put it to me. One of the things you get from doing something for decades is a very broad and deep understanding of the entire system. If you've been a developer for 35 years you've not only seen fads come and go, but you've also had a chance to use numerous systems from numerous perspectives and on both sides of the user/developer fence. It only works if you've kept learning though. I've found that older devs occupy an extreme "U" distribution -- they're either utterly outdated or they're super-brilliant and can leverage tons of experience. Another source of the problem is a lack of emphasis on -- or even contempt for -- UX among systems level (so-called "neckbeard") type developers. "Real men don't need ..." Last but not least you've got the business models of many infosec companies which revolve around "streaming" constant "definition updates," patches, and selling loads of different one-off fixes for little problems.
      • digi_owl 12y ago
        I don't think it is a contempt at the existence of UX. But when UX gets in the way of efficiency. Something like being able to wrap up a common task in a script, rather than having to constantly poke at that wizard with its 1001 next buttons.
  • ksenzee 12y ago
• lugg 12y ago
  You painted a very biased view of those emails. Its quite clear he doesn't hate security or security related projects, he simply doesn't see them as the special snowflakes the opsec guys think they are. Paraphrasing, bugs are bugs, they need to be fixed, and publishing how to exploit them in commit logs is a stupid idea. It's also quite clear he isn't against embargo / coordinated release, he just doesn't want to deal with the, and I quote here, "masturbating monkeys". I generally don't agree with linus' tact on most occasions but that wasn't anything spectacular and pretty well explained.
• xfs 12y ago
  Linus explains his stance on Linux security, issues with security people, SELinux, CVE commit log, etc. at DebConf 14: https://www.youtube.com/watch?v=1Mg5_gxNXTo#t=3936 https://www.youtube.com/watch?v=1Mg5_gxNXTo#t=3936
• gpvos 12y ago
  That was an interesting and enlightening read. Thank you.