(Just in case, this is an security issue because it enables constant dosing, as well as clears the resolver cache making spoofing easier)
(Also... gotta be honest that's sort of a vanity CVE. Note the complete lack of details in the report itself, it never saw an eyeball after it was filed. It's valid enough, but frankly I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.)
Poettering is dismissive of nearly every bug. Remember when systemd would default to starting units as root when it couldn't parse the username? We're not talking about some minor piece of software like a sound multiplexing daemon, we're talking about the core userland piece of every Linux install. Bug reports on something that central should be taken seriously and with a minimum of snark.
I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.
All the more reason to reduce the attack vectors and ensure that your code is well thought out, and coded defensively. That you have too many security issues to generate CVEs for each and every one is a problem in and of itself. Ten years ago how many people thought that all of these speculative execution side channel attacks were possible or practical?
This seems like it needs some citation. There certainly have been bugs. I think it's legitimate to talk (with specifics!) about cultural issues with systemd's development and its impact on security. But I don't see that this statement is particularly well supported. In particular I genuinely don't know what you're referring to with respect to ignored/suppressed bugs and CVEs.
I mean, systemd is a lot of code and makes up a big chunk of the system plumbing these days. Obviously it's going to make up a big chunk of the bug budget. People don't get upset about flaws in someone's random cgroup launcher or encrypted block device manager or daemon wrapper not because those projects don't have bugs, but because basically no one uses them. Because basically everyone is using systemd!