McGrath: Red Hat’s commitment to open source

Posted Jun 27, 2023 8:18 UTC (Tue) by TRauMa (guest, #16483)
In reply to: McGrath: Red Hat’s commitment to open source by pbonzini
Parent article: McGrath: Red Hat’s commitment to open source

I couldn't recommend a distro where security fixes are deliberately held back to anyone. And I'm not talking about embargoes, all the fixes. It's one of the ways Red Hat "adds value" to RHEL.

McGrath: Red Hat’s commitment to open source

Posted Jun 27, 2023 12:41 UTC (Tue) by pizza (subscriber, #46) [Link] (2 responses)

> I couldn't recommend a distro where security fixes are deliberately held back to anyone. And I'm not talking about embargoes, all the fixes.

Then you'd be happy with CentOS stream, which lands non-embargoed fixes *before* they go out into RHEL, meaning at worst it's no slower than the pre-Stream rebuild flow.

> It's one of the ways Red Hat "adds value" to RHEL.

Um, you act like "adding value for your paying customers" is a bad thing.

McGrath: Red Hat’s commitment to open source

Posted Jun 30, 2023 19:31 UTC (Fri) by kpfleming (subscriber, #23250) [Link] (1 responses)

Just for clarity, repeating what has been posted on one of the other LWN article threads:

This is not true. Fixes for 'low' and 'moderate' severity CVEs are generally made 'in the open' in CentOS Stream and then appear in RHEL when the next batch of updates for that RHEL stream are published.

Fixes for 'important' and 'critical' CVEs (embargoed or not) are made in RHEL first, in private repositories, shipped to RHEL customers (and generally do not wait for batch updates but are shipped as soon as they are ready), and are then made in CentOS Stream as the RHEL developer gets time to push the changes there. This could be minutes, or hours, or days, but wouldn't often be more than a few days.

McGrath: Red Hat’s commitment to open source

Posted Jul 1, 2023 2:56 UTC (Sat) by passthejoe (guest, #156034) [Link]

This is very good to hear, and is something Red Hat and CentOS people should be talking about non-stop.

If CentOS Stream is worth speaking up for, a whole lot of people should be doing it.