Received-SPF: pass (google.com: domain of linux-kernel+bounces-69297-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Date: Fri, 16 Feb 2024 21:27:48 +0100 (CET)
From: Jiri Kosina <jikos@kernel.org>
To: Josh Poimboeuf <jpoimboe@kernel.org>
cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, corbet@lwn.net, 
    workflows@vger.kernel.org, linux-doc@vger.kernel.org, 
    linux-kernel@vger.kernel.org, security@kernel.org, linux@leemhuis.info, 
    Kees Cook <keescook@chromium.org>, 
    Konstantin Ryabitsev <konstantin@linuxfoundation.org>, 
    Krzysztof Kozlowski <krzk@kernel.org>, 
    Lukas Bulwahn <lukas.bulwahn@gmail.com>, Sasha Levin <sashal@kernel.org>, 
    Lee Jones <lee@kernel.org>
Subject: Re: [PATCH v4] Documentation: Document the Linux Kernel CVE
 process
In-Reply-To: <20240216192625.o3q6m7cjgkwyfe4y@treble>
Message-ID: <nycvar.YFH.7.76.2402162108370.21798@cbobk.fhfr.pm>
References: <2024021500-laziness-grimace-ed80@gregkh> <20240216192625.o3q6m7cjgkwyfe4y@treble>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII

On Fri, 16 Feb 2024, Josh Poimboeuf wrote:

> - Not users of -stable since they already know they need to be on the
>   latest version.
> 
> - Not distros or their users as it's just flooding them with low quality
>   CVEs which have no analysis or scoring.
> 
> And enterprise distros will never be able to rebase onto -stable,
> especially for older streams for which they have to be very selective,
> in order to avoid destabilizing them.  As you say, "a bug is a bug".

Now that you have played the distro card (thanks!) here, let me just copy 
my comment from LWN where someone suggested "well, it's easy, it's the job 
of the [paid] distros to do the triage" ...

The problem is, that with this new system, paid distros are going to 
suffer a big time (with no benefit to anybody at all). We'll have to put a 
lot of productive and creative (upstream) work on hold in order to have 
enough resources to sort out the havoc that LTS team is apparently going 
to create by DoSing the world with a truckload of irrelevant CVEs.

-- 
Jiri Kosina
SUSE Labs