A missed point

This is undoubtedly true.

As a general rule, many commit messages are not as informative as they could be or should be. Andrew Morton regularly rants about this. I personally find that writing a good commit message helps me find problems with the commit often enough that it is clearly worth while. It seems that others don't :-(

So commit messages don't guarantee anything, and they could certainly be better.

But that doesn't excuse removing security related information from commit messages, or deliberately leaving it out. We should always include anything useful that we know. We cannot justify leaving info out because some other commit message doesn't have that kind of info.

So sure: if people only back-port commits which say "bug fix" or "security issue" in the commit message, then they are being foolish. But it is not our place (or Linus' place) to stop people from being foolish.

It *is* our place to make the code and the code-history as easy to understand and maintain as possible.

Linus' argument isn't about being secure/insecure by selectively backporting patches per se (it's not a boolean property) but whether one's more or less secure/insecure by doing selective backporting or just flowing with his git HEAD. by covering up security fixes he effectively makes that choice for everyone, and that doesn't fly well with people who believe they know better (by virtue of not providing kernels based on his git HEAD to their users, which i believe covers about 99.99999% of all linux users).

In particular, *any* wild pointer write or use-after-free bug in any random driver should be considered a security bug.