Michael Catanzaro Seems to be Missing the Point
Calling people you disagree with "Ostriches" is lazy name-calling
Michael Catanzaro is no longer "tracking newly-reported security issues" in GNOME (as of 2 days ago, the Red Hat catastrophe day). Catanzaro has just written two posts, one of them long and complete with detailed tables. He argues that slop bug reports are becoming a real issue (not only a growing number) and says or sort of insinuates they should be reported/filed/documented with CVEs ("How to Request a CVE"). It's a time-consuming human task. CVEs earned their notoriety for many reasons and some want to replace this system completely. They have legitimate reasons.
Catanzaro isn't too rude in my experience (although he was a bit crabby towards people I know). Here is where he and many other people at GNOME diverge (some wish to altogether ban not only slop but also people caught using slop to waste other people's time).
I've been writing software for over 30 years and I have a rough idea of the role played by frameworks/languages, bad architecture (including defective, faulty chips that cheat to fake speed/performance), bad programming, and classic multi-task environments (where several different programs run in tandem on the same CPU, same physical RAM etc.) so I am not some clueless 'knob-head'.
Bugs and their severity are all relative. Many of the bugs we hear of all the time assume a multi-tenanted environment (different users presumed hostile towards one another), a connected (to the outside world) unit/s, rogue inputs (like badly-formed, malicious, rogue media files crafted to cause harm), and all sorts of "shared servers" or "cloud" (what I've long compared to public toilets in the "sanitation" sense).
Suppose you write a program that runs locally on a machine (some cheap SBC) where you're the sole human user. Suppose this program takes as input something from a known (and trusted) Web/Net address - for some reason or another. What can possibly go wrong? Not much.
But now they sell us programs as "containers", hosts/hardware as "clouds", small software as "apps" (from centralised stores connected to MAGA and the NSA), pages as "webapps" (where no JavaScript is needed to attain the base functionality) and so on.
Suddenly even little crease or defect gets magnified and there's a cascade or escalation, wherein some tiny buffer overrun/overflow can result in something much worse than a pesky crash.
Slop machines aren't good at finding meaningful bugs (we amassed many citations that reinforce this assertion; no "ostriches") but at generating many candidates thereof. Like fuzzers, which have existed and have been used for decades, they generate a mountain of noise (with many needles presumed to be locatable inside the heap). If someone wishes to waste (or "invest") one's time sorting out false positives in a fast-growing queue, then good luck.
Catanzaro found himself in a position of having to do this (shockingly, he was the only one in GNOME doing so). Now he's out, either burned out or burned by IBM (Red Hat). █
Image source: The Ostrich