Their view that security bugs are just normal bugs remains very immature and damaging. It it somewhat mitigated by Linux having so many eyes on it and so many developers, but a lot of problems in the past could have bee avoided if they adopted the stance the rest of the industry recognizes as correct.

▲

tptacek 6 hours ago | parent | next [-]

From their perspective, on their project, with the constraints they operate under, bugs are just bugs. You're free to operationalize some other taxonomy of bugs in your organization; I certainly wouldn't run with "bugs are just bugs" in mine (security bugs are distinctive in that they're paired implicitly with adversaries).

To complicate matters further, it's not as if you could rely on any more "sophisticated" taxonomy from the Linux kernel team, because they're not the originators of most Linux kernel security findings, and not all the actual originators are benevolent.

▲

rwmj 6 hours ago | parent | next [-]

For sure, but you don't need to file CVEs for every regular bug.

▲

Skunkleton 5 hours ago | parent [-]

In the context of the kernel, it’s hard to say when that’s true. It’s very easy to fix some bug that resulted in a kernel crash without considering that it could possibly be part of some complex exploit chain. Basically any bug could be considered a security bug.

▲

SSLy 5 hours ago | parent [-]

plainly, crash = DoS = security issue = CVE.

QED.

▲

michaelt 4 hours ago | parent | next [-]

BRB, raising a CVE complaining the OOM killer exists.

▲

pamcake 3 hours ago | parent | next [-]

Memory leaks are usually (accurately) treated as DoS. OoM killer is a mitigation to contain them and not DoS the entire OS.

▲

worthless-trash an hour ago | parent | prev [-]

I could be wrong. But operation by design isn't considered a bug.

	▲	samus 3 minutes ago \| parent [-]
		[delayed]

▲

5 hours ago | parent | prev [-]

[deleted]

▲

JCattheATM 5 hours ago | parent | prev [-]

> From their perspective, on their project, with the constraints they operate under, bugs are just bugs.

That's a pretty poor justification. Their perspective is wrong, and their constraints don't prevent them from treating security bugs differently as they should.

	▲	ada0000 5 hours ago \| parent [-]
		> almost any bugfix at the level of an operating system kernel can be a “security issue” given the issues involved (memory leaks, denial of service, information leaks, etc.) On the level of the Linux kernel, this does seem convincing. There is no shared user space on Linux where you know how each component will react/recover in the face of unexpected kernel behaviour, and no SKUs targeting specific use cases in which e.g. a denial of service might be a worse issue than on desktop. I guess CVEs provide some of this classification, but they seem to cause drama amongst kernel people.

▲

schmuckonwheels an hour ago | parent | prev | next [-]

Linus has been very clear on avoiding the opposite, which is the OpenBSD situation: they obsess about security so much that nothing else matters to them, which is how you end up with a mature 30 year old OS that still has a dogshit unreliable filesystem in 2026.

To paraphrase LT, security bugs are important, but so are all the other bugs.

	▲	JCattheATM 44 minutes ago \| parent [-]
		OpenBSD doesn't really stress about security so much as they made that their identity and marketing campaign - their OS is lacking too many basic capabilities a security focused OS should have. > To paraphrase LT, security bugs are important, but so are all the other bugs. Right, this is wrong, and that's the problem. Security bugs as a class are always going to be more important than certain other classes of bugs.

▲

jacobsenscott 4 hours ago | parent | prev | next [-]

Classifying bugs as security bugs is just theater - and any company or organization that tries to classify bugs that way is immature and hasn't put any thought into it.

First of all "security" is undefined. Second, nearly every bug can be be exploited in a malicious way, but that way is usually not easy to find. So should every bug be classified as a security bug?

Or should only bugs where a person can think of a way on the spot during triage to exploit that bug as a security bug? In that case only a small subset of your "security" bugs are classified as such.

It is meaningless in all cases.

	▲	therealrootuser 3 hours ago \| parent \| next [-]
		> nearly every bug can be be exploited in a malicious way This is a bit contextually dependent. "This widget is the wrong color" is probably not a security issue in most cases, unless the widget happens to be a traffic signal, in which case it is a major safety concern. Even the line between "this is a bug" and "this is just a missing, incomplete, or poorly thought out feature" can get a bit blurry. At a certain point, many engineers get frustrated trying to pick apart the difference between all these ways of classifying the code they are writing and just want to get on with making the system work better.
	▲	JCattheATM 4 hours ago \| parent \| prev [-]
		> First of all "security" is undefined. Nonsense.

▲

akerl_ 5 hours ago | parent | prev | next [-]

This feels almost too obvious to be worth saying, but “the rest of the industry” does not in fact have a uniform shared stance on this.

▲

firesteelrain 6 hours ago | parent | prev | next [-]

“A bug is a bug” is about communication and prioritization, not ignoring security. Greg’s post spells that out pretty clearly.

	▲	JCattheATM 9 minutes ago \| parent [-]
		Yes, that's what I was criticizing....

▲

themafia 4 hours ago | parent | prev | next [-]

> a lot of problems in the past could have bee avoided

Such as?

▲

beanjuiceII 6 hours ago | parent | prev [-]

did you read it? because that's not their view at all