<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="ltr">On Mar 9, 2020, at 03:45, Ayoub Zaki <ayoub.zaki@embexus.com> wrote:</div><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><span>Nothing to discuss in public.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>This</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>has been the situation from the start of the project, certainly this was</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>the case 5 years ago when I joined it, and the only person ever to make an</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>issue out of it is you. Everyone else seems to understand the deal they're</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>getting by using Yocto without a commercial support contract.</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>...</span><br></blockquote></blockquote><blockquote type="cite"><span>You are saying that 'track and fix CVEs' is on users.</span><br></blockquote><blockquote type="cite"><span>Let's check what YP is telling users.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Click on the "Is Yocto Project for you?" link on the YP frontpage:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>https://www.yoctoproject.org/is-yocto-project-for-you/</span><br></blockquote><blockquote type="cite"><span>13. Yocto Project follows a strict release schedule incorporating</span><br></blockquote><blockquote type="cite"><span>security patches in all supported releases. This predictability is</span><br></blockquote><blockquote type="cite"><span>crucial for projects that are based on Yocto Project and allows the</span><br></blockquote><blockquote type="cite"><span>development teams to plan their activities. Developers can choose which</span><br></blockquote><blockquote type="cite"><span>Yocto Project branch on which to base their activities as a function of</span><br></blockquote><blockquote type="cite"><span>their needs. The development branch will ensure access to the latest</span><br></blockquote><blockquote type="cite"><span>features while the stable branches will reduce the pace of changes. CVEs</span><br></blockquote><blockquote type="cite"><span>(common vulnerabilities and exposures) issues are supported for the</span><br></blockquote><blockquote type="cite"><span>latest 2 releases.</span><br></blockquote><span></span><br><span></span><br><span>Adrian is making a point here, The Yocto Project by claiming that it supports security patches for Stable releases is misleading the Users!</span><br><span></span><br><span>I work with different customers and some of them think that by using and pulling the latest releases they will get the CVEs automatically fixed!</span><br><span></span><br><span>YP should state that CLEARLY! Of course it will impact the choice of going with Yocto or Not ( probably NOT in this case).</span><br></div></blockquote><div><br></div>Would the Yocto mailing list [1] be a good venue to reach the maintainers of the Yocto website? There are now a handful of OE-arch / OE-core threads on this topic, which could be consolidated into a single thread on the Yocto list, where participants can act on recommendations.<div><br></div><div><div>Rich</div></div><div><br></div><div>[1] <a href="https://lists.yoctoproject.org/g/yocto">https://lists.yoctoproject.org/g/yocto</a></div><br></div></body></html>