[e-dant]

What's all this controversy with GNOME? I must be missing something. Isn't it perfectly reasonable to say that some security issue in a dependency (which is maintained and open and funded, like WebKit or Linux) is not the fault of someone down the line to fix?

I can't imagine someone reporting a bug to one of my repos about some race condition in the kernel. Why the hell are you bothering me with that? Tell the LKML.

That's not to say I'm not sympathetic, it's just, like, what do you expect me to do?

[yjftsjthsd-h]

One the one hand: Yes, if it's not your code then it's not exactly your responsibility to fix.

On the other hand: As a user, the takeaway isn't "well that's not their fault", the takeaway is "if I use this software, then I am vulnerable to this problem". The question of who's responsible or where the fault lies is irrelevant.

[dooglius]

> what do you expect me to do?

Off the top of my head: you could broadcast it more publicly that there is a known issue (particularly important if this is a security issue). You could change code to avoid whatever kernel features trigger the race. You could print a warning if you detect the kernel version is an unpatched one and/or has Kconfig in whatever state exposes the issue.