Read the followup by pagexec

Yes, there's also a fundamental problem: fixing bugs requires very concentrated attention - which narrows any thinking about what potential side-effects of a bug can have in practice.

Bug fixers are, very fundamentally, concentrated on understanding *one* specific symptom and then finding the bug, then going to the 'big picture' of the intent of the code and changing the code (and related code) into correct code which implements the original 'big picture' intent.

Note what is missing from those thought patterns: figuring out *other* obscure symptomatic ways to use unintended side-effects of the bug to bring some application (or the kernel) out of its intended path of execution and use that to inflict harm on the system ...

The bug fixer is simply not interested in it because that information is *immaterial* to him: he is interested in *fixing* the bug and then reviewing the rest of the logic to make sure it implements intent correctly.

So bug fixes, even by the best bug fixers, do not carry full information about whether some obscure side-effect of the bug may have some security impact.

Attackers on the other hand only deal with specific bugs and know the various patterns that are dangerous in terms of bringing apps off their regular execution pathways. They also know the various obscure side-effects that bugs can cause and which can be used creatively to elevate privileges. In essence attackers know how to turn existing structure against its own intended purpose, i.e. they know how to be *parasites*.

So this is a fundamental (almost genetic) conflict between 'doers' and 'parasites', and we cannot expect doers to think like parasites, and i argued in my mail that putting CVEs into change-logs only makes the situation worse, not better.

There might be other schemes that improve security - so this is not a refusal to do sensible things at all, it is a refusal to do nonsensical things.