[OE-core] Does YP provide security support for stable and LTS branches?

[Adrian Bunk]

On Wed, Mar 04, 2020 at 05:00:44PM +0100, Alexander Kanavin wrote:
> Taking offense or getting angry at the yocto project is entirely
> misdirected.

I am not angry if YP does not provide security support.

I am angry when YP is telling lies that it would provide security 
support, but does not actually provide it.

> The liability for insecure millions of devices does not lie
> with the yocto project, it lies with the OEMs.
>...

The liability for insecure millions of devices lies 100% with the Yocto 
Project if it claims to provide security support but does not actually 
provide it.

If a user has to decide today whether an upcoming product will run
Ubuntu 20.04 LTS or Yocto 3.1 LTS, then it should be clear to the
user whether or not choosing Yocto will provide upstream security 
support the same way as Ubuntu.

A user reading the YP LTS announcement expects security support similar 
to what Ubuntu is offering, and might only notice that this isn't true 
after a known vulnerability gets exploited on millions of devices.

If security support for YP stable and LTS releases is only on a
community support basis and usually incomplete, then it is on YP
to make that clear to all users instead of claiming the opposite - in 
other projects LTS does include security support, sometimes only 
security fixes are permitted.

This could be combined with a call for help for security support,
an advantage of being honest would be that it becomes visible for
users that there is a resource shortage.

> Alex

cu
Adrian