Red Hat refuses Alma's CVE patches to CentOS Stream; says "no customer demand"

I haven't been really keeping up with this RHEL drama, so I'm probably going to regret making this comment. But about this bug merge request in particular, you have to remember that RHEL's main target audience is paying enterprise customers. It's the "E" right there in RHEL. So stability is a high priority for their developers, since if they accidentally introduce a bug to their code, then they'll have a lot of unhappy paying customers.

The next comment that was cropped out of that screenshot basically explains exactly that. While the Red Hat developers probably appreciate the bug fix, the reality is that the bug was listed as non-critical, and the Red Hat teams didn't have the capacity to adequately regression test and QA the merge request. But the patch was successfully merged into Fedora, so it will eventually end up in RHEL through that path, which is exactly what the Fedora path is for.

The blowup about this particulat bug doesn't seem justified to me. Red Hat obviously can't fix and regression test every single bug that's listed in their bug tracker. So why arbitrarily focus on this one medium priority bug? if it were listed as a critical bug, then yes, the blowup would be justified.

"Your code has an issue here's a fix for that".

Corporate: no.

Wasn't Red Hat just complaining that Alma and Rocky didn't add value because they weren't submitting fixes upstream?

Alma should use this as advantage for them. Now market it as "Alma Linux is more secure than RHEL".

As someone interviewing for Canonical's Security team (they make you do like 10 interviews, I'm like 5 deep over 3 weeks), I cannot imagine anyone security-minded writing that comment. It either:

• Comes from higher up
• Michal doesn't think security is important

2023: The Year of the Assholes

Alright, at first I was like okay red hat wants to make money to keep IBM happy. Now I just realize it's not read hat anymore. Fuck that I'm moving to suse

Everyone is going to have to accept that RHEL is over and done. Since paying customers are not allow to release the code publicly, overtime it could turn into its own ooerating system that happens to use the Linux kernel, similar to Android.

Forget about Red Hat, they're gone, they're not an option for any small company. Individuals should never have been using Red Hat, but companies are going to have to find something else like Debian/Devuan, FreeBSD, something with a stable branch that gets 3 to 4 years of updates.

It still requires a substantial amount of time to review the fix. Depending on the circumstances it might require more time to review a piece of code than to write it.

It's a bold strategy, Cotton. Let's see if it pays off for them.

Debian posted fixes for this at about the same time this fix was proposed.

Maybe I just don't get it, but how does this work in any way that doesn't make them liable for some company being exploited by something that they were aware could've been prevented?

This makes me much more upset than Red Hat asking people to rebase on CentOS Stream.

This is ridiculous.

I'm sure on CentOS/RHEL7 this will be irrespectivly classified a CVE score of 7.8 so they don't need do security updates for it.

That's too much effort. Just advertise the CVE fix and let a paying customer do the effort.

"You code has an issue, here is a fix for that issue ready to be used."

Corporate: no.

wow

Redhat is going full IBM

I mean obviously for the community this is bad, but I 100% get that doing anything for free is best effort. They don't even need to have this policy 100% of the time to make large orgs using FOSS with no SLA for vulnerability patching sweat. Which frankly they should.

For real, I'm gonna use this as a tactic to say "we shouldn't rely on software without warranty and support, FOSS or proprietary.". Just to get money flowing to devs, because for it's for real reckless to contribute nothing to keeping pieces of your critical infra secure

And this is why I use Ubuntu server.

Permanently Deleted