Saying you can solve the existence of bugs in any code repository reeks of bullshit. Anyone who believes this is possible is just ignorant.
While true essentially forking the latest stable version of the kernel to make an LTS branch or a vendor version only multiplies the problem, it also does not contribute to solving it.
technically it’s possible…
Theoretically. I don’t think it’s even technically possible.
Delete all the code. Then you’ll have no bugs.
Touché.
Delete all the bugs. Then you’ll have no code.
LOL, all Linux vendors = Red Hat.
All generalizations are false.
It’s funny, because there was research done by UC Riverside which specifically figured out LTS branches receive patches for CVEs significantly later than vendor specific branches. Specifically:
Interestingly, we note that the picked CVE patches appear in distributions 74.2 days earlier than LTS on average;
They also conveniently left out the part of Greg KH’s opinion stating that he recommends the use of vendor kernels over stable/LTS branches, too.
I found this particularly funny:
It all comes down to a delicate balancing act between security and stability. Some top Linux kernel developers and CIQ are coming down on the side of security.
Now I know CIQ is “supposedly” different from rocky, but what is CIQ going to do, break bug-for-bug compat and use stable kernels in their supported version of Rocky? This entire article feels like it doesn’t fundamentally understand that not all bugs (especially ones that lead to potential low-ranking CVEs) aren’t worth patching.
We’re training too many “security” people.
Turns out the biggest bug of all was keeping the default password.
