arendjr@programming.devtoLinux@programming.dev•Linux Foundation endorses Chromium, SteamOS ISO is coming Linux & Open Source news
41·
2 days agoI agree the Linux kernel is just fine. But that’s only because despite the security risks of C, there’s no viable alternative kernel.
But development doesn’t stand still, so either Linux catches up, or gets replaced when a viable alternative arrives. Thankfully Linus sees the problem, so they’re working to make the kernel viable a while longer, but I also agree with the person you replied to that this work could definitely use a bit more help.
Sorry, but this mindset is hurting both Linux and security in general.
This is frankly quite obviously false. Microsoft started taking security more seriously around the release of Windows 2000. Are you saying the Linux kernel developers took another 15 years to realize security is important?
Security research shows that new code is more prone to common vulnerabilities than old code is. While old code may have been designed with weak (or no) security considerations, those are well-mitigated by now. On the contrary, new code still regularly contains exploitable memory safety issues that slip by review.
We have skilled programmers who understand security. Those also understand that we need more than that.
Continuing to use C doesn’t merely require skilled programmers, it requires programmers that never make any mistake ever. That’s an infeasible standard for any human to uphold, hence why C is considered a risk.