Earlier quoted context omitted.
> Is this "Linux is garbage" opinion shared broadly by security researchers? Everyone I know would agree, yeah. I think the infosec world is probably more or less aligned on this, as much as anything, although that's a low bar and there is no single infosec community. > what is "alienating" Decades of Linus and Greg insulting or attacking security researchers in various ways. It's become pretty antagonistic on both s…
Fair enough. While I understand that there may not be any body which perfectly represents the infosec community, I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). No doubt that Linus is antagonistic. I haven't heard anything that suggests security researchers as a collective have taken it personally (I would expect they, like most people, understan…
Hmmm, I'm not sure if anything like that exists, certainly nothing from a standards body. The closest might be recommendations to not rely on things like Linux containers, or to be wary of kernel vulnerabilities. But usually official bodies don't make comments like "this software is bad".
> I haven't heard anything that suggests security researchers as a collective have taken it personally
I assure you that they do, I know many people who have been active in Linux kernel security for decades.
> It seems pretty meaningless and unhelpful to categorize all C software as "garbage".
Oh yeah, what I meant is that all of these things are factors. I'm sort of hand-wavingly justifying the "garbage" description. There's a lot of problems that are all interwoven. C is one of those problems.
> To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor.
That's fair. I would probably point to the lack of testing/ coverage, the lack of code review, the huge LOC:maintainer ratio.
> Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage"
I'd have to disagree here. I don't believe I need to have an example of something better in order to point out that there's something bad.