Re: [ANNOUNCE] linux-stable security tree

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Apr 12, 2016 at 08:22:37AM +0200, Willy Tarreau wrote:
> I think we may have more of an issue educating our users than an issue
> with the code we distribute.

I think that's the issue here, combined with users that just don't want
to upgrade as it's "hard" for them.  There's nothing we can do about
making it easier than we already do, and really, taking 200 patches is
just the same work for them to take 100 patches in a release, so I
don't buy the "I only want a small subset of fixes" argument, as it
doesn't make any sense.

So I worry that this tree will give people a _false_ sense of security,
thinking that they have properly covered the needed fixes when really,
there are lots of fixes they didn't even know they needed that got
applied to the "normal" stable tree for issues they will hit.

Also, people need to stop being afraid of the large numbers of stable
patches, and compare it to the overall % of changes, and realize that
what we take in stable releases is really a trivially small number of
the overall changes made to the kernel.  So much so that you might argue
that it's safer to run the real kernel releases and not rely on stable
releases :)

thanks,

greg k-h