It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.

The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.

Just a title designed to generate the maximum outrage followed by a few meaningless lines.

> The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.

Yes it does? And Ubuntu is selling security subscriptions and doing a poor job of it, These aren't open source volunteers, this is a paid product.

But Ubuntu is not some small distro maintained by unpaid volunteers; they are a corporation that offers paid support. I think it reasonable to be disconcerted when a company that you are paying for security updates is this negligent, especially when other distros have fixed this issue far more expediently.

This is a major failure on Ubuntus part. The constructive feedback they deserve is literally the title of the article.

The post gives enough detail, there is a vulnerability that allows root access on servers on the TCP stack, so literally accessible if you are running any service. There are exploits in the wild. Debian has the patched kernel, Ubuntu does not 2 weeks after the CVE is known.

> how critical it is,

9.8 out of 10 btw.

> how it is impacting them personally,

They are clearly rather upset by the lack of an appropriate response.

> how vulnerable their servers are,

They are literally open to anyone with an AI subscription.

> how they are working around it.

They are migrating off Ubuntu.

The post is making 0 demands, they're made a valid statement and moving off Ubuntu.

It's a large international corporation with hundreds of millions in revenue from enterprise contracts. There is in fact a manager to speak to and I do in fact demand to speak to them.

> The post gives no details about what this vulnerability is

It is a very famous vulnerability that has been all over tech news sites. Sometimes it is ok to assume the audience has the slightest bit of background knowledge about the topic at hand.

With Open Source / Free Software we're trying an alternate economic model, shooting to overtake the standard model. We rely on volunteers. It creates an awkward situation where we can't be unappreciative of effort (no matter the quality of output), but we also have to have expectations or this model is just not going to work.

So we should respectfully expect better than this. (With the caveat that Canonical is a business. I'm using Ubuntu Pro for free so I won't be berating them, but I think I paying customers perhaps should be.)

I also think that we should consider a sort of an "SLA" concept. If you say "I got you covered" and you drop the ball, I think I do have a grievance in that I could have chosen another option, and now I have to take the time to adjust. On the other hand sometimes people don't actually say "I got you covered" they say "This is a cool thing I'm working on". So something like an "SLA" could clear that up.

> It’s okay to have criticism, but at least be constructive about it.

Nah, if you're dropping the ball after you said you wouldn't and I trusted that, I'm going to get angry and loud when you drop the ball. That's just reality, and Ubuntu isn't some Johnny-come-lately volunteer organization. They're one of the most well-funded Linux organizations in the world.

> at least be constructive about it

I think the proposed solution here is pretty clear. Patch the bug.

Very helpful information, thanks!

But Ubuntu is not the embodiment of "open source". It's a business. With managers...

>The post gives no details about what this vulnerability is, how critical it is

what? the literal first paragraph says:

"In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely"

I believe you will have a ton of factual page about that. The purpose of this one is exactly what you criticise: rage. With a small error of margin a justified rage. I believe this was the reason it was chosen for submission: to show the rage.

The whole point of paying for Ubuntu enterprise services is you don't have to worry about all this nonsense. It's one thing if you're using Ubuntu for free, it's another thing when you're paying them for a specific service.

> This “I demand to speak to the manager” energy should be kept out of open source.

This. You are welcome to publish patches and demonstrate how people can fix their own machines out of band with what Ubuntu does. This costs you... 10 minutes with AI help?

While it's easier than ever to complain this year, I'm patching all the things while on a walk or not at my computer, it's great!

Welcome to the world of tomorrow