<story><title>Linus Torvalds Talks Linux Security at LinuxCon</title><url>http://www.eweek.com/enterprise-apps/linus-torvalds-talks-linux-security-at-linuxcon.html</url></story><parent_chain></parent_chain><comment><author>riskable</author><text>Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security?  Those two vulnerabilities had nothing to do with Linux.&lt;p&gt;Software using OpenSSL or bash on &lt;i&gt;any&lt;/i&gt; platform were vulnerable.  That includes Macs and Windows.&lt;p&gt;Linux is extremely popular for servers and embedded systems where OpenSSL and bash are common but bringing them up every time &amp;quot;security + Linux&amp;quot; are discussed is a bit like talking about tires that blow out whenever the topic of logistics comes up.</text></comment>
<story><title>Linus Torvalds Talks Linux Security at LinuxCon</title><url>http://www.eweek.com/enterprise-apps/linus-torvalds-talks-linux-security-at-linuxcon.html</url></story><parent_chain></parent_chain><comment><author>mrweasel</author><text>&amp;gt;Most of the security issues we&amp;#x27;ve had in the kernel have been just completely stupid bugs...&lt;p&gt;Wouldn&amp;#x27;t that be an argument to be more stringent in reviewing and auditing the kernel code? I don&amp;#x27;t know to which extend they already do audits, but if you find a bug of a certain type, maybe consider combing the tree for other instances of that type of bug. I believe that&amp;#x27;s the approach OpenBSD has taken.</text></comment>