I've been waiting for almost a decade now. In the meantime I've run systemd in production on thousands of servers (with no audio card) at multiple jobs. How much longer should I wait for horrible things to happen, or can I safely assume that they're not happening?

Is remotely exploitable (!) CVE in systemd [1] not horrible enough? Or accidentally bricking computers at hardware level [2]?

1: https://nvd.nist.gov/vuln/detail/CVE-2018-15688

2: https://lwn.net/Articles/674940/

You're moving the goalposts. I was supposed to be horrified at bad things like PulseAudio being merged in, not vague bad things in general. If anything, the fact that none of these servers use networkd nor (until very recently, well after that bug was fixed) UEFI is a sign that in fact systemd isn't a giant glob and I can pick and choose components. So, bring on the PulseAudio merge, if it's anything like networkd I have nothing to fear.

He was very specific.

That is a vulnerability in networkd, not in the init system.

If you want to count like this you might as well speak of vulnerabilities in GNU.

From the second link you posted:

> None of that completely ended the systemd squawking, but it was clear to most that the real problem lies in the UEFI implementation.

So I am not sure what you hoped to prove here.

I had no idea that code vulnerability and bugs was a thing lennart invented, too!

Like no other system software ever had a CVE.