Post #3189077

2026-05-03 18:26 UTC

@buherator@infosec.place @joshbressers@infosec.exchange @gregkh@social.kernel.org I wouldn't call it an externality, since it only affects those who use Linux. It's not like you had a perfectly peaceful software ecosystem and suddenly someone started making Linux, which makes you suffer even if you don't use Linux. No, it only hurts you if you do use it, and the alternative is no Linux at all.

Replies (2)

@buherator@infosec.place 2026-05-04 06:20

@wolf480pl@mstdn.io @joshbressers@infosec.exchange @gregkh@social.kernel.org I don't think a negative externality has to affect *everyone*. We can argue about who are 1st, 2nd, and 3rd parties in this game, but in the end suboptimal vulnerability management (caused by arguably bullshit CVEs) definitely hurt the security of end users who don't have a say about which vendors their service provider choose (not that there are many orgs out there today who can run without Linux, so this demand is a bit unrealistic too).

Open ##3635110
@Suiseiseki@freesoftwareextremist.com 2026-05-04 16:13

@wolf480pl@mstdn.io @buherator@infosec.place @joshbressers@infosec.exchange @gregkh@social.kernel.org It does not affect those who configure GNU Linux-libre correctly and don't have such bloated module compiled in. Many GNU/Linux distros don't seem to include such module - although Debian does.

Open ##3635111