Damn @terdon why isn't that antivirus question worthy of the linux tag? I'm halfway to my linux gold badge lol

@jesse_b Heh, sorry. Because it has nothing to do with the Linux kernel.

Or Linux in any way, really.

@terdon It kind of does, ctime and mtime oddities are related to the kernel and all the various linux filesystems

The question seems specific to the pitfalls of trying to apply this policy to a linux OS

@jesse_b Two things. First, I could have sworn that meta post I linked wasn't something I had asked and answered. That... kinda weakens my argument to be honest. Second, you're not wrong about the filesystems, but the kernel? Is that involved? In any case, the OP was focusing on find and generating a list of files for a virus scan and that doesn't seem related to Linux.

That said, I also see where you're coming from, so I won't object or roll back if you want to add the tag back. @JeffSchaller @Kusalananda wanna weigh in?

the kernel determines when ctime and mtime are modified and therefore knowledge of the kernel would be knowledge of how to bypass those changes

Yeah. See that faint line back there in the distance? That's the limit of my understanding of this sort of thing, and we have gone WAY beyond it.

If you say so, I'm sure you're right. I really don't know how this kind of thing works in detail.

well I'm not sure either lol I'm kind of leaning on chatgpt here

It just seems to me a question that is related to the fundamentals of how the linux operating system works (albeit specifically files and filesystems).

and op mentions linux systems instead of any specific distro so it's possible they are working with multiple distros

Honestly, I think you're grasping a bit cause you're close to the tag, but that doesn't mean you're wrong :P

I dunno even your own meta answer includes two examples pretty much exclusively about filesystems

s/two/three/

I'm just having trouble seeing this as being about filesystems (none were mentioned; yes, the ctime handling changes depending on filesystem, but that doesn't seem to be what the question was about).

The question is essentially whether or not it's safe to rely on ctime being accurate

Seriously though, you do make good arguments. Go ahead and add the tag back, just add some explanation of why in the edit message. As I said, while I am not convinced, I am also not 100% that I am right and the tag doesn't belong. So if you feel it does, go for it.

@terdon naw I'll wait for someone else to chime in

@StephenKitt would know what to do lol

I hope Stéphane answers that question though, would be interested to see what he has to say

@terdon I've long-since given up on trying to personally understanding the role of the Linux tag here. I was misguided? differently-guided? early on, and apparently not in keeping with the community's wishes, so I stopped retagging around this area. My opinion here, though, is that the question is explicitly about a Linux environment, and that's what the tag and the Meta Answer suggest in that case.

Tag: "Use this tag for questions that are specific to Linux-the-operating-system (GNU/Linux)" (though it then lists "hardware support" which I'd think fits better with the linux-kernel tag)

Meta answer: "In my opinion, this tag should only be used for cases where a question is asking about how a Linux OS works" -- Question: "I need to scan Linux systems for ..."

sorry lol...I'll just gather my things and leave

Just like distribution-related tags are often used on questions only because the user uses a particular distribution, the Linux tag is too often used on questions only because the user uses Linux. Neither question or answers might have anything to do with Linux and might as well be applicable to e.g. macOS or FreeBSD.

I think that's the case in this case too.

I delete the Linux tag from questions when it occurs in tandem with a distribution-related tag. If I started reading the questions more closely, I'm guessing I would also begin to delete the distribution tags from most questions in favour of tags relating to particular packaging systems or whatever the question is actually about (that's mostly what separates the distributions anyway).

@Kusalananda that is a good point however I would argue only coincidentally because the freebsd kernel and filesystems handle ctime in a similar way and the filesystems are often interchangeable with linux (ie zfs). It might still differ slightly from kernel to kernel but I would wager it's safe to say do not trust ctime on any *nix OS

although I'm sure it's easily modified on windows as well I just know from experience it's unreliable on linux

The way ctime is supposed to work is prescribed by POSIX.

touche

posix.opengroup.org/register.html

Although no operating systems are certified anymore

If the filesystem made such a big difference to old stuff like mtime and ctime, we would see a lot more questions about interoperability issues between filesystem (with regards to timestamps).

btime, yes, that's different.

@jesse_b I find it hard to believe that a developer would drastically change the way timestamps work just because "we're not certified anyway".

I mean, there's a reason Unix succeeded way more than Plan9 ever did.

@Kusalananda I don't disagree

Although you and I both know that many decisions regularly made by developers would not be considered logical, and these decisions often make their way into critical systems that you would expect to have significantly better controls. Still seems like a real stretch for the linux kernel though

@jesse_b in this instance I favour timestamps which is what the question is about, rather than linux which is just the general context.

sad face