I hate to bring up his tone, but that's what his tone does: it distracts from his point, and inevitably directs the discussion towards him and his outbursts.
I can re-write his response to be concise and firm, but polite. It'll just take a second:
> "This petition is misguided. We use rdrand as _one_ of many inputs into the random pool, and we use it as a way to _improve_ that random pool. Even if rdrand were to be back-doored by the NSA, our use of rdrand actually improves the quality of the random numbers you get from /dev/random. All of the relevant code is found in drivers/char/random.c, if you want to see for yourself."
Sigh. Always the same complaint.. A couple of thoughts:
1. He is expected to comment or answer questions like this ALL THE TIME. People only have so much patience. Don't believe me? Go to a poor country as a tourist and see how quickly your tone changes when poor people constantly approach you. Or ask a good looking young woman how it is for her when she goes out.
2. Life is tough, deal with it. This expectation that everything has to be nice and safe and friendly all the time lead, amongst other things, to the NSA mess we have right now, as Schneier pointed out recently [1]. We want EVEN MORE safety. And you want everyone to be nice. Well, what do you prefer? Some tough love from a guy like Linus, or friendly words that neither help you improve your knowledge (in this case) or, worse, someone that pretends that you are doing alright when, in fact, you aren't.
3. If this kind of communication helps to weed out people that are incompetent more successfully than other methods, then isn't it acceptable?
Finally, and this is a little bit of an unnecessary tounge in cheek comment, I recommend you go watch an old Sergio Leone western. And then reflect what a guy like Clint Eastwood would have to say about your comment. Not, much, I suppose. ;)
Any manager of a high profile/pressurised project has to answer 'stupid' questions all the time. That doesn't mean they all react like children. In my opinion managers tend to earn more respect when they don't.
Linus has earned the respect of the tech community for other reasons, but that doesn't mean you have to defend everything he does.
The point is, if his goal is to truly make him understand, he can achieve that goal MUCH faster if he doesn't hurt the ego of the person he is having an argument with. When your intelligence is insulted, you will spend a lot more time defending yourself rather then accepting a point.
This is true on a micro, per-interaction scale. On a macro scale, it can be more beneficial in the long run for people's egos to be hurt when they're wrong. For someone like Torvalds, the macro scale of interaction matters a lot.
You're basically supporting the "everyone's a winner" mindset. Sure, on a micro scale, tell the kid they were a winner for participating, guide them, and for that particular interaction everyone comes out ahead. On the macro scale, it's better to feel the sting of being wrong so you can learn from it.
And at the same time, there's discussions about the lack of new blood working on Linux (https://news.ycombinator.com/item?id=6298493). I'm not saying this is the only reason why, but it certainly doesn't help attracting new people to a project.
Completely agreed. When you insult someone personally, they will defend themselves much sooner then they will accept your point. Instead of arguing against his point, he insulted the petition makers intelligence. When trying to make a point to someone, it's always better to do it without hurting their ego. Always.
Some people don't know that they're ignorant, especially when they make crap petitions like this. "Few blame themselves until they have no other choice."
... Yeah. It's actually quite a small amount of code which manages the random pool, and it's well documented and fairly clear. So if you're in doubt, go read it before jumping to conclusions!
If people are really worried, they shouldn't be petitioning. They should be collecting donations so that they can hire a security professional to audit the code in question.
You can't audit RdRand because it's hardware, not software code:
>It is impossible for software to tell whether this instruction is actually returning random numbers or whether it has been deliberately subverted, either by Intel, by a malware microcode patch, or by a virtual machine operating system. One of the standards it relies on, NIST SP800-90, was led by an NSA employee and contained subverted randomness standards.
Imagine being in his position. I imagine that he does not really want to respond to it since the authors don't know what they are talking about yet he somehow has to since otherwise people could get suspicious. And imagine if this happened twice a day. Also it's one of the things that looks pretty good on the poster's resume, not so much on Linus'.
No, his statements that wind up being called douchey are the things that catch the mainstream's attention. When he was speaking to initiates, he wasn't being douchey, because describing him as someone who says douchey things is an invention of the mainstream.
I think when someone has been "right" for long enough, argumentation tone and attitude tend to deteriorate. As such, I wonder who from a linguistic viewpoint has the least abrasive way to express themselves, Linus Torvalds today or Richard Stallman 1997.
Seeing engineers in leadership positions (and being one myself), I've learned you can't use this kind of language when you're in a position of power and respect. It doesn't end debate (like Linus probably thought he was doing), but shifts it to his behavior and just creates more distractions.
While I doubt it's an issue in practice, I have a real hard time believing that a compromised source of randomness actually improves the function. If it does, the algorithm is presumably not well designed in the first place - which would be similarly concerning.
I can re-write his response to be concise and firm, but polite. It'll just take a second:
> "This petition is misguided. We use rdrand as _one_ of many inputs into the random pool, and we use it as a way to _improve_ that random pool. Even if rdrand were to be back-doored by the NSA, our use of rdrand actually improves the quality of the random numbers you get from /dev/random. All of the relevant code is found in drivers/char/random.c, if you want to see for yourself."