Why Linus Torvalds Slammed Kernel Security Hardening – A Deep Dive

Recently on the kernel mailing list, Linus Torvalds used his typical blunt language to criticize the security community.

It started when Google Pixel security team developer Kees Cook submitted a pull request to harden usercopy; Torvalds replied that such hardening is usually considered only at the very end because it touches core code, requires time to review, and he does not trust security developers to act sensibly. The initial usercopy hardening caused many problems, and he explicitly said he would not merge it into 4.15, not wanting another hardening‑induced chaos.

In subsequent mailing‑list discussion, Torvalds berated security people, calling many of their actions unacceptable.

He emphasized that security issues are mainly bugs and labeled many security developers “f*cking morons”. He argued that hardening projects should first reflect on themselves, focus on debugging, and that the “shoot first, ask questions later” approach of these “idiots” is wrong.

Robert Graham wrote an article explaining why Torvalds is right; interested readers can follow the link.

Source: Solidot URL: http://www.solidot.org/story?sid=54563