Linus Torvald's Security Smackdown

khess 0 Tallied Votes 367 Views Share

Linus Torvalds, creator of the Linux kernel, posted a on security nerds and their obsession with security in the gmane.linux.kernel newsgroup. Linus is referring to security professionals who feel that security should be the only focus for bug fixes and patches.

His argument is that all bugs are equally important and security bugs are simply a part of the greater whole. Linus often posts his irritation with security experts in this newsgroup. In his most scathing reprimand of the security-focused, he states the following:

Security people are often the black-and-white kind of people that I can't
stand. I think the OpenBSD crowd is a bunch of masturbating monkeys, in
that they make such a big deal about concentrating on security to the
point where they pretty much admit that nothing else matters to them.

Linus also dislikes the whole media circus (and the media, in general, I gather) surrounding security because it glorifies and encourages the wrong behavior making heroes out of security people. He feels that his primary responsibility to the Linux Community is to do a good job in creating and maintaining a viable Linux kernel and not fall prey to the media feeding frenzies that take place every time a security vulnerability is discovered.

The bottom line is that the major maintainer of the Linux kernel, Linus himself, perceives bug fixes, which include so-called security fixes, as just that: Bug fixes. He doesn't separate or even explicity refer to security fixes because to him "They're all fixes. They're all important. As are new features, for that matter."

Linux is a registered trademark of Linus Torvalds.

Dani AI

Generated

This thread frames a real engineering tradeoff: highlights Linus' long‑running position that a "fix is a fix," while reminds us that attackers do find and exploit kernel bugs. Both views are valid — correctness and feature work matter, but exploitable defects require a faster, disciplined response.

Security bugs are a subset of bugs that carry an extra dimension: exploitability and real‑world impact. That usually calls for a different workflow (rapid triage, focused testing, coordinated disclosure, and careful backports) because a rushed or poorly tested patch can introduce regressions that harm users more than the original flaw. That explains why some maintainers resist treating every report as an emergency: quality and stability still matter.

Practical checklist for maintainers and admins:

  • Reproduce the issue and assess exploitability before labeling urgency.
  • Keep fixes minimal and add regression tests where possible.
  • Backport only well‑tested fixes to stable/LTS kernels and document the change.
  • Coordinate disclosure with downstream vendors and assign/refer to a CVE when appropriate.
  • Operators: run vendor‑supported LTS kernels, stage updates in a test cluster, and subscribe to distro/kernel security advisories.
  • Use OS hardening (SELinux/AppArmor, compiler hardening, least privilege) and reduce exposed attack surface to lower risk while patches are prepared.

Final note: contest demos and script kiddie tools (as mentioned by ) show one side of risk but are not a substitute for disciplined triage and patch management. The healthiest projects and operators combine Linus' engineering rigor with security processes that prioritize, test, and communicate fixes responsibly.

jwenting 1,905 duckman Team Colleague

how do you feel now, Linus, that people are exposing the gaping holes in your "secure" operating system?

khess 95 Practically a Master Poster

At the Hacker's conference, it was never hacked. MacOS X fell first, then Vista, but never Linux. Maybe they don't know what they're doing.

jwenting 1,905 duckman Team Colleague

Indeed. At such events it's mostly script kiddies working with ready made hacking kits. And the Windows (and these days MacOS versions) they're given as targets are lacking security updates.
The organisers have an agenda, and that's showing how bad Windows and Mac are compared to Linux.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.