<story><title>Linus Torvalds Talks Linux Security at LinuxCon</title><url>http://www.eweek.com/enterprise-apps/linus-torvalds-talks-linux-security-at-linuxcon.html</url></story><parent_chain><item><author>riskable</author><text>Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security?  Those two vulnerabilities had nothing to do with Linux.&lt;p&gt;Software using OpenSSL or bash on &lt;i&gt;any&lt;/i&gt; platform were vulnerable.  That includes Macs and Windows.&lt;p&gt;Linux is extremely popular for servers and embedded systems where OpenSSL and bash are common but bringing them up every time &amp;quot;security + Linux&amp;quot; are discussed is a bit like talking about tires that blow out whenever the topic of logistics comes up.</text></item></parent_chain><comment><author>UnoriginalGuy</author><text>So by that logic, it is unfair to criticise flash and or Java as Windows security issues?&lt;p&gt;It seems like Linux people want to shift the definition of &amp;quot;Linux&amp;quot; between only the kernel and the entire OS when it is convenient. In this case we&amp;#x27;re shifting down the definition to &amp;quot;kernel only&amp;quot; so we can avoid talking about Linux (the OS&amp;#x27;s) potential security issues.&lt;p&gt;Heartbleed and Shellshock are Linux (OS) issues. Just because that same software may ship on BSD and OS X is entirely irrelevant. Linux was still by far the largest target (just like Windows is the largest target of cross-platform Java vulnerabilities).&lt;p&gt;Linux as a kernel is pretty freaking secure. Linux as an OS has a lot of issues, and many (most?) popular distributions are a large part of why (e.g. SELinux is often disabled by default and a lot of packages are incompatible, a lot of services run as root by default, a lot of packages are installed by default (not the minimum), etc).</text></comment>
<story><title>Linus Torvalds Talks Linux Security at LinuxCon</title><url>http://www.eweek.com/enterprise-apps/linus-torvalds-talks-linux-security-at-linuxcon.html</url></story><parent_chain><item><author>riskable</author><text>Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security?  Those two vulnerabilities had nothing to do with Linux.&lt;p&gt;Software using OpenSSL or bash on &lt;i&gt;any&lt;/i&gt; platform were vulnerable.  That includes Macs and Windows.&lt;p&gt;Linux is extremely popular for servers and embedded systems where OpenSSL and bash are common but bringing them up every time &amp;quot;security + Linux&amp;quot; are discussed is a bit like talking about tires that blow out whenever the topic of logistics comes up.</text></item></parent_chain><comment><author>mhurron</author><text>&amp;gt; Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security?&lt;p&gt;Because they&amp;#x27;re big, popular, well known names that effect software that typically runs on Linux systems so everyone goes &amp;quot;mm yep, that was a big Linux issue.&amp;#x27;&lt;p&gt;The Linux kernel has issues, but you&amp;#x27;re not making your case that Linus doesn&amp;#x27;t take things seriously when your examples have nothing to do with Linus&amp;#x27; work.</text></comment>