Red Hat refuses Alma's CVE patches to CentOS Stream; says "no customer demand"

In its blog post Red Hat specifically called out downstream distributions for not contributing anything to the development of RHEL and that they should be making fixes to CentOS Stream. Well, this is a fix for CentOS Stream and Red Hat still doesn't care. They just don't want community contributions.

Except that they are not expecting to merge this into RHEL. They are sending it to CentOS Stream.

But it is also another stab in the community, they took centos that was a community project for them, then transformed this project that was downstream to upstream, then called all other downstream distros a negative net worth cause they don't engage in the process of RHEL, then blocked the acess to this distros to the downstream, then reject the work of this ppl they called net negative without a decent process.

What actually red hat wants?

Centos now is only a beta branch? Ppl who wants derive from centos should be fixing everything downstream and duplicate work cause centos now is just an internal beta from red hat? If yes, why they took the project from the community? I'm not a rpm based distros user but I totally understand why ppl are pissed.

That could have been better communicated though. What you said is reasonable, what Michal said isn't as much.

Fedora is where this sort of thing is supposed to go. That's been Red Hat philosophy since forever. Patch as high upstream as you can. Sounds like this is a non issue.

Agree on point of detail, but the "drama" is the reason for the fuss. Redhat's communication, especially to the community that helped build and support it, has always been patchy, but over the past few years it's been apalling. As others have pointed out, they've insulted a lot of us, specifically for not contributing upstream - so it's not unexpected for them to be called on it when someone does.

I think the EL sphere as a whole (including RHEL and all up and downstreams) is getting drastically weakened directly because of Redhat's poor decision making, and that's a shame for all of us.

Maybe you should familiarize yourself with CentOS Stream and its purpose.

There goes the narrative. Didn't last very long, did it?

Its funny how podcasters and commenters seem to have taken Redhat's spin about "contributing value to the community" seriously, while to the rest of us the whole thing was obviously only about money (same as all the follow-ups from other parties... I would say "including Alma" but that would probably deserve its separate debate).

— "we don't like people ripping off our work without any added value"

— "Here, let me push this to your staging environment, totally breaking your quality process"

— "No"

— "Well, what the hell do you want broo?"

I don't think they have ever hidden the fact this is about money. I don't like the fact this is about money, but the fact that others were cloning and selling their efforts for a cheaper price is awful.

Fuck it, let's go Alma!

Can you prove that your joining Canonical (picture proof), as you know, people can be anything in the internet while they're in their parent's basement.

If you are, what type of interview questions do they ask?

Truth! I wasn't shocked that all the social media and entertainment companies all decided to treat the Covid years as if that growth was organic/normal (all retail stores started doing this much faster). As if people were just going to keep having the same amount of time to spend on them. Or in the case of sites like Reddit, they think that they are the creators of content instead of the location to get it. Companies like Red Hat are more jarring and seem like they would've been more realistic.

The next two paragraphs are just a rant about companies and the government not really caring for stability long-run. Feel free to ignore.

Of course people were going to start unsubbing now that they need to focus on actual things needed for just living. Covid has shown that all these greedy folks running (or holding shares) companies in all sectors refuse to just be focused on stability. They act like all the crazy large profits were all because of their "genius innovative ideas and leadership." Of course that was going to happen to all the publicly traded companies, due to their literal legal obligation to always make numbers go up. But shit is beyond a bad way to handle the real material conditions of life. It also doesn't help that the US did a worse job at doing things like monthly stimulus money compared to other places.

A capitalist economy requires that people keep buying both needed and wanted things in order to keep things moving around. But instead of putting money into the hands of people, which would then likely buy more things or even have finally something to save for when things normalized (which would be helpful for making the falloff less dramatic). We barely got two total $2000 payments. Fuck, even just making sure folks could have money to finally get out of various debits would mean people could more easily justify keeping things like Netflix.

Red Hat literally became the first ever billionaire FOSS company (iirc), their pre-selling out business model was working perfectly fine.

RHEL ultimately comes from Fedora (plus Redhat has a great say in where Fedora is headed), so... RHEL won't become sort of an AIX or HPUX anytime soon.

That said, Redhat's move opens up the position of "enterprise-like distro for scientific/technical shops and other people who do their own support" (think, from CERN to small software houses) that so was the reign of RHEL clones (together with Ubuntu, of course).

Those are people who will probably never buy RHEL licenses for all their machines no matter what, so in a sense it stands to reason that RH doesn't care about them (if you think their move is about money rather than falling for the "value to the community" PR spin), but those same people are also trend setters whose choices, in time, trickle down to universities and then companies, and to me it looks like there's a huge opportunity there (and that Alma is currently in the best position to harvest from it in the long run).

Why do people care about RHEL? Is it really any better than Debian based stuff?

Maybe, but in practice nothing happens. Microsoft has had numerous issues reported to them before, years ago, and the issue reported to them was never fixed or taken seriously. Then years later, the issue is sometimes rediscovered and they find the report from years earlier, and nothing happens.

Until legislation gets passed to force companies to take liability of their software, nothing will change.

Free market at work!

[This comment has been deleted by an automated system]