Creepy as hell company. Had a good free Linux distro, but it's not that good anymore. It's coasting on inertia these days.
But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.
So if it's a critical security concern to your company, open your laptop and get to work.
Either this was used to pop something big, or this is a jia tan situation going down.
I thought there was a flamebait automation that was prevent this sort of velocity (unless overridden)
People with affected systems have been waiting ever since for canonical to ship ... something, anything. Or maybe communicate the blockers. Crickets, though.
It gets all the more egregious if you're a paying customer for Ubuntu Pro (which thank god, our company is not).
It is absolutely taking the proberbial piss when you put it into context of their bold shiny new ambitions posted on September 23rd on their official blog (https://canonical.com/blog/accelerating-delivery-of-cve-fixe...) ... failing every single listed requirement in that announcement, now 14+ days, after initial CVE disclosure.
No need for a tin-foil hat here at all. Ubuntu has a large installbase. Part of which hosts servers. And if I had to take a wild guess that userbase is about to shrink dramatically going forward.
Unlike Arch or even Debian, Canonical has dozens of kernels to test and verify. The downside of supporting your software for ten years across multiple chipsets and even offering in-between kernel updates is that you need to test and maintain a shitload of kernels. Testing all of those takes time.
I hope they do a write-up about what went wrong here but all the big companies were weeks late to the party. My guess is that some of the patches were causing issues when backported, or Red Hat would've released updates much sooner as well.
Well - Ubuntu sold out to marketing rather than engineering.
Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.