Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@korg vs. linux-distros@

[Jiri Kosina <jikos@kernel.org>]

On Tue, 15 Aug 2023, Greg KH wrote:

> > Really, if you think about it. The closest product to the user
> > is the distro. If someone finds a bug in the kernel, they can see if they
> > can exploit a distro with it. If they can, perhaps they should send it to
> > the security folks of the distro first. Then the distro can send it to
> > security@kernel.org. Maybe this already happens?
> 
> The huge majority of Linux use in the world is Android, everything else
> is a rounding error. 

Sorry, but in my view this is a slight oversimplification.

Sure, Android is ultra-huge, with userbase being the metric.

But you very well aware of where Linux as an server/enterprise distro is 
running, and that's big as well. And you can't just count that by "number 
of deployments/users" metric. Stock exchanges, air traffic control, NASA, 
govermental insitutions of all sorts, you name it.

And, at the end of the day, all those huge deployments then directly 
contribute back to kernel development, by allowing companies like Red Hat, 
SUSE, Canonical, ... to put kernel engineers on their payroll.

So I'd like to (with both my community and distro hats on now :) ) make 
sure they/we can proceed with that without unnecessary hurdles.

[ .. paragraps about how enterprise/server distributions are irrelevant 
     stripped here :) .. ]

> So the top end (Android and Debian and kernel.org) are covered today 
> with stable/LTS releases.  Same for the bottom end 
> (Fedora/openSUSE/Arch/etc.)  

Are they? I don't think Fedora is picking LTS as a base for the kernel. 
openSUSE definitely is not. So how are they covered?

Thanks,

-- 
Jiri Kosina
SUSE Labs