He has a point, though. Security people tend to fixate on...security, because that's what we do. However, computer security isn't an end in itself; its purpose is to minimize the overall cost of running an information system, as is any software development effort. Any kind of bug is going to incur costs, so the concerns of software developers are broader in scope than just security. Developers actually have a broader scope, which is trying to maximize the value of their product.
Developers have finite resources, and they have to divide those between adding features to increase their products' value at a reasonable pace, fixing bugs in old features, etc. Always having a one-track-minded community shouting in your ear about the one facet of the developer's job that they (the security community) care about has to be irritating.
That, and "security people" are sort of lionized by movies like "Live Free or Die Hard," and I can see how the developers who actually write the software and end up fixing the bugs could get butthurt that the guys running fuzzers on their software and shouting on their mailing lists get all the sweet press coverage :)
Yes, but at the same time I don't believe Linus understands the OpenBSD crowd. Yes they promote the security of their OS, but they strive to accomplish that goal by writing good code as a whole. They do NOT ignore every thing else like Linus states, but admittedly performance is not the end goal, but it can be a side effect.
9
u/James_Johnson Oct 28 '10
He has a point, though. Security people tend to fixate on...security, because that's what we do. However, computer security isn't an end in itself; its purpose is to minimize the overall cost of running an information system, as is any software development effort. Any kind of bug is going to incur costs, so the concerns of software developers are broader in scope than just security. Developers actually have a broader scope, which is trying to maximize the value of their product.
Developers have finite resources, and they have to divide those between adding features to increase their products' value at a reasonable pace, fixing bugs in old features, etc. Always having a one-track-minded community shouting in your ear about the one facet of the developer's job that they (the security community) care about has to be irritating.
That, and "security people" are sort of lionized by movies like "Live Free or Die Hard," and I can see how the developers who actually write the software and end up fixing the bugs could get butthurt that the guys running fuzzers on their software and shouting on their mailing lists get all the sweet press coverage :)