<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 10.03.20 17:11, Ross Burton wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAnfSTt5fwx3a7pPotvqrwgW58+n-UxCQiZqiAFuuJz6K+=aqg@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">On Mon, 9 Mar 2020 at 07:45, Ayoub Zaki <a class="moz-txt-link-rfc2396E" href="mailto:ayoub.zaki@embexus.com"><ayoub.zaki@embexus.com></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Adrian is making a point here, The Yocto Project by claiming that it
supports security patches for Stable releases is misleading the Users!
I work with different customers and some of them think that by using and
pulling the latest releases they will get the CVEs automatically fixed!
YP should state that CLEARLY! Of course it will impact the choice of
going with Yocto or Not ( probably NOT in this case).
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
What would the alternative to Yocto be, and what is their security
policy? Does e.g. buildroot commit to fixing every known security
issue (which is more than just known CVEs) in their releases?</pre>
</blockquote>
<p><br>
</p>
<tt><span style="color: rgb(34, 34, 34); font-size: 16px;
font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; letter-spacing: normal; text-align:
left; text-indent: 0px; text-transform: none; white-space:
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); text-decoration-style:
initial; text-decoration-color: initial;"></span></tt>
<p><span style="color: rgb(34, 34, 34); font-family: arial,
sans-serif; font-size: 16px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-align: left;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); text-decoration-style:
initial; text-decoration-color: initial;"><tt>Security patches
support is definitely for many companies a knock-out
criterion.<br>
Probably in this case Debian or a commercial OSes like Qnx
would be a choice for who can afford it.</tt></span></p>
<p><span style="color: rgb(34, 34, 34); font-family: arial,
sans-serif; font-size: 16px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-align: left;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); text-decoration-style:
initial; text-decoration-color: initial;"><tt></tt><br>
</span>
</p>
<pre class="moz-signature" cols="72">Mit freundlichen Grüßen / Kind regards
--
Ayoub Zaki
Embedded Systems Consultant
Vaihinger Straße 2/1
D-71634 Ludwigsburg
Mobile : +4917662901545
Email : <a class="moz-txt-link-abbreviated" href="mailto:ayoub.zaki@embexus.com">ayoub.zaki@embexus.com</a>
Homepage : <a class="moz-txt-link-freetext" href="https://embexus.com">https://embexus.com</a>
VAT No. : DE313902634</pre>
</body>
</html>