Torvalds: Fed up with 'security circus'

Middle ground needed between secrecy and hype, says the creator of the Linux kernel.

Linus Torvalds, creator of the Linux kernel, says he's fed up with what he sees as a "security circus" surrounding software vulnerabilities and how they're hyped by security people.

Torvalds explained his position in an e-mail exchange with Network World this week. He also expanded on critical comments he made last month that caused a stir in the IT industry.

Last month Torvalds stated in an online posting that "one reason I refuse to bother with the whole security circus is that I think it glorifies -- and thus encourages -- the wrong behavior. It makes 'heroes' out of security people, as if the people who don't just fix normal bugs aren't as important. In fact, all the boring normal bugs are way more important, just because there's a lot more of them." Never one to mince words, Torvalds also lobbed a verbal charge at the OpenBSD community, deriding them with some colorful language for "mak[ing] such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them."

Via e-mail, he also explained why he finds security people to be so irritating.

Too often, so-called "security" is split into two camps: one that believes in nondisclosure of problems by hiding knowledge until a bug is fixed, and one that "revels in exposing vendor security holes because they see that as just another proof that the vendors are corrupt and crap, which admittedly mostly are," Torvalds wrote.

Torvalds went on to say he views both camps as "crazy."

"Both camps point fingers at each other as a way to cement their own reason for existence," Torvalds charged. He says a lot of activity in both camps stems from public-relations posturing.

He says neither camp is absolutely right, and that a middle course, based on fixing things as early as possible without a lot of hype, is preferable.

"You need to fix things early, and that requires a certain level of disclosure for the developers," Torvalds stated, adding, "You also don't need to make a big production out of it."

Torvalds also says he doesn't care for labeling updates and changes to Linux as a security fix in a security advisory.

"What does the whole security labeling give you? Except for more fodder for either of the PR camps that I obviously think are both idiots pushing for their own agenda?" Torvalds wrote. "It just perpetrates that whole false mind-set" and is a waste of resources, he added.

It's better to avoid sticking solely to either "full and immediate disclosure" or ignoring bugs that might embarrass vendors, he argued. "Any situation that allows the vendor to sit on the bug for weeks or months is unacceptable, as is any situation that makes it harder for people who find problems to talk to technical people."

Torvalds says he's skeptical about the value of synchronized releases among vendors that rely on an embargo of software vulnerability information until a fix from a vendor is ready.

That process discourages thinking about design changes to make it harder to have security bugs, Torvalds argued. "So, the whole 'embargoes are good' mentality is just corruption from the vendors," he said. "But on the other hand, disclosure should not be the goal."

"I don't believe in either camp," Torvalds concluded. What he does favor is to "have a model where security is easier to do in the first place -- that is, the Unix model -- but make it easy for people to report bugs with no embargo, but privately."

He said the Linux kernel security list "is private" in the sense that "we don't need to leak things out further" to get some software issue fixed. He says the process allows, though doesn't encourage, a five-day embargo, and "even then, I will forward it to technical people on an 'as-needed' basis, because even that embargo secrecy is not some insane absolute thing."

This story, "Torvalds: Fed up with 'security circus'" was originally published by Network World.

Copyright © 2008 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon