I haven't been really keeping up with this RHEL drama, so I'm probably going to regret making this comment. But about this bug merge request in particular, you have to remember that RHEL's main target audience is paying enterprise customers. It's the "E" right there in RHEL. So stability is a high priority for their developers, since if they accidentally introduce a bug to their code, then they'll have a lot of unhappy paying customers.
The next comment that was cropped out of that screenshot basically explains exactly that. While the Red Hat developers probably appreciate the bug fix, the reality is that the bug was listed as non-critical, and the Red Hat teams didn't have the capacity to adequately regression test and QA the merge request. But the patch was successfully merged into Fedora, so it will eventually end up in RHEL through that path, which is exactly what the Fedora path is for.
The blowup about this particulat bug doesn't seem justified to me. Red Hat obviously can't fix and regression test every single bug that's listed in their bug tracker. So why arbitrarily focus on this one medium priority bug? if it were listed as a critical bug, then yes, the blowup would be justified.
As someone interviewing for Canonical's Security team (they make you do like 10 interviews, I'm like 5 deep over 3 weeks), I cannot imagine anyone security-minded writing that comment. It either:
Everyone is going to have to accept that RHEL is over and done. Since paying customers are not allow to release the code publicly, overtime it could turn into its own ooerating system that happens to use the Linux kernel, similar to Android.
Forget about Red Hat, they're gone, they're not an option for any small company. Individuals should never have been using Red Hat, but companies are going to have to find something else like Debian/Devuan, FreeBSD, something with a stable branch that gets 3 to 4 years of updates.
Alright, at first I was like okay red hat wants to make money to keep IBM happy. Now I just realize it's not read hat anymore. Fuck that I'm moving to suse
It still requires a substantial amount of time to review the fix. Depending on the circumstances it might require more time to review a piece of code than to write it.
Maybe I just don't get it, but how does this work in any way that doesn't make them liable for some company being exploited by something that they were aware could've been prevented?
I mean obviously for the community this is bad, but I 100% get that doing anything for free is best effort. They don't even need to have this policy 100% of the time to make large orgs using FOSS with no SLA for vulnerability patching sweat. Which frankly they should.
For real, I'm gonna use this as a tactic to say "we shouldn't rely on software without warranty and support, FOSS or proprietary.". Just to get money flowing to devs, because for it's for real reckless to contribute nothing to keeping pieces of your critical infra secure