Bonum Certa Men Certa

The Free Software Community is Exploited by Greedy Business People, It's Not Freeloading (Yet More Name-calling, Trolling and Shaming of Volunteers)



Reprinted with permission from Ryan Farmer

IBM’s new pejorative for people who use Fedora or an Enterprise Linux clone. “Freeloader” (And they don’t want to know about security holes.)



A word that IBM and their fanboys, and remaining unpaid volunteers are bandying about lately, is “Freeloader”.



In IBM Red Hat’s book, anyone who isn’t currently coughing up a subscription fee to use RHEL is “Freeloading”. Basically, they see you as a parasite.



This word doesn’t just apply to a person who grabs Fedora and uses it on their laptop and never files bug reports or anything. It applies more broadly to organizations that deploy a free Enterprise Linux clone to their business because they think they can self-support.



It also applies specifically to Oracle, because even before IBM, Red Hat was already trying to portray Oracle Linux as some sort of “stolen product” with their “Unfakeable Linux” marketing campaign.



Let’s talk about users. Fedora has always had a very transactional relationship with users from Red Hat’s point of view. Users were valuable as bug reporters. We’d get this software on our daily systems for free, and in return, when something went wrong, we were “requested” to file bug reports.



However, IBM doesn’t value bug reports because as the new boss in town, it’s not actually interested in fixing bugs. It wants to hide them, like Microsoft, according to AlmaLinux developers who tried reporting security vulnerabilities in RHEL components.



KnownHost CTO and AlmaLinux Infrastructure Team Leader Jonathan Wright recently posted a CentOS Stream fix for CVE-2023-38403, a memory overflow problem in iperf3. Iperf3 is a popular open-source network performance test. This security hole is an important one, but not a huge problem. Still, it’s better by far to fix it than let it linger and see it eventually used to crash a server.



That’s what I and others felt anyway. But, then, a senior Red Hat software engineer replied, “Thanks for the contribution. At this time, we don’t plan to address this in RHEL, but we will keep it open for evaluation based on customer feedback.” 



[…]



The GitLab conversation proceeded: 



AlmaLinux:  “Is customer demand really necessary to fix CVEs?” 



Red Hat: “We commit to addressing Red Hat defined Critical and Important security issues. Security vulnerabilities with Low or Moderate severity will be addressed on demand when [a] customer or other business requirements exist to do so.”



AlmaLinux: “I can even understand that, but why reject the fix when the work is already done and just has to be merged?” 



At this point, Mike McGrath, Red Hat’s VP of Core Platforms, AKA RHEL, stepped in. He explained, “We should probably create a ‘what to expect when you’re submitting’ doc. Getting the code written is only the first step in what Red Hat does with it. We’d have to make sure there aren’t regressions, QA, etc. … So thank you for the contribution, it looks like the Fedora side of it is going well, so it’ll end up in RHEL at some point.”



One user wrote, “You want customer demand? Here is customer demand. FIX IT, or I will NEVER touch RHEL EVER.” While another, snarked, “Red Hat: We’re going totally commercial because Alma never pushes fixes upstream! Also, Red Hat: We don’t want your fixes, Alma!”



On Reddit, McGrath said, “I will admit that we did have a great opportunity for a good-faith gesture towards Alma here and fumbled.”



Finally, though the Red Hat Product Security team rated the CVE as “‘Important,’ the patch was merged.

-ZDNet Article “AlmaLinux discovers working with Red Hat isn’t easy”


The attitude that Microsoft and IBM share in security vulnerabilities is that they don’t want to touch the fix, even if someone else already wrote it, because it may cause a regression that they then have to spend time and money sorting out.



Microsoft’s attitude is so bad that they use old and insecure versions of gnupg to generate package signatures on their “Linux” software, but it also hardly matters because they point dnf on Fedora or RHEL to their server to get the .asc file, which means that users who have Microsoft programs on their computer can get a copy that’s been tampered with as an “update” and not have any warning, because the attacker can modify the .asc with one that they control, and put that one on the server as part of the attack.



I think it’s, frankly, frightening, that IBM admits that security patches are not one of their highest priorities in such a widely used system as RHEL.



Instead of getting caught up in the “security poser” malarkey, and buzzword bullshit bingo, like Matthew Garrett does with his nerve-grating overuse of things like “attestation”, “TPM”, and “roots of trust”.



These things are not security. If the software you’re using is garbage, your security is garbage. You need to use software from people who just fix their damn bugs, and vendors who get you those patches shipped ASAP. Everything else is basically pointless.



My roots of trust are simple. It’s on my computer, I trust it. Fuck off.



The first and last time I’ve had a computer virus, it was on Windows 98, and Chernobyl (it was set to trigger a malicious BIOS flashing until the ROM was bricked). Thankfully, I pulled it out in time.



I have never had any “Linux malware”, and that record is unbroken since 1998.



Seriously, patch your software, get it from a legitimate source, and don’t worry too much.



If a company is like Microsoft and IBM, and doesn’t want to know about security holes, they don’t deserve their customers on that issue alone.



Where were we? Ah, yes. Freeloading. IBM’s open contempt for Fedora is even worse.



They are throwing out many unpaid volunteers that were doing free work for IBM Red Hat, and calling those people “Freeloaders”, with absolutely no sense of irony, apparently. IBM gets a lot of software for free.



They stopped paying the FSF around the time Molly de Blanc and other unproductives, like Garrett (his last useful code was in the 2000s, I think, when he worked on ACPI), organized people around a defamatory petition against Richard M. Stallman, which Roy Schestowitz points out is a 70 year old man.



But IBM still pulls GNU software without paying for it. And many other people’s software! FREELOADERS!



Users of free clones can be future customers.



The “free” developer license for RHEL, does not allow you to deploy it across your whole organization, get settled in, and then realize you need support after all.



The free clones were an ongoing source of new customers, who would often bring lots of machines with them by the time they approached Red Hat and wanted to do an in-place conversion. This was a serious amount of money.



IBM says they’re just Freeloaders and harasses the distributions that onboard customers into the “Red Hat” way of doing things and land them clients.



Even when they don’t make sales, their product gets more marketshare, which was why they were a de facto “standard”.



Oracle “Freeloading”.



Perhaps most of all, Red Hat (pre-, and post-IBM) had disdain for Oracle Linux, but Oracle didn’t have compelling reasons to lure people away from RHEL wanting an identical product. Oracle is not the authoritative source of RHEL, IBM is. Whatever Oracle consumes is what IBM decided to put in there.



A customer education campaign on this subject would have been better than labeling Oracle as some sort of “stolen product”.



Oracle is not going for exactly the same customers. They have their own “Unbreakable Enterprise Kernel” that is really quite different already, and which boots by default.



UEK is modified to run Oracle-type workloads better than the RHEL Compatible Kernel, but despite this, the compatibility issues with it are rare.



The Linux kernel version does not directly interact with very many programs in userspace so as long as you have a stable kernel that’s getting serviced by someone who knows what they’re doing, you’re probably going to be fine running the RHEL userspace on top of it, which makes IBM’s decision to obscure their kernel all the more bizarre.



The future of RHEL clones is not entirely under IBM’s control anyway.



Already, an alliance (Open Enterprise Alliance Association) of SUSE, Oracle, and CIQ (sponsor of Rocky Linux) have come together to make a “commons” out of the Enterprise Linux source code.



Ironically, the alliance’s Web site pokes fun at IBM.



“The Community Repository for Enterprise Linux Sources No subscriptions. No passwords. No barriers. Freeloaders welcome.



Essentially, IBM has succeeded only in angering a great many people with their antics including washing their hands of Fedora this week, and spurred their competitors into an alliance to reduce the work of maintaining competing RHEL clones.



This has all been so very stupid and avoidable.



The media (bribed) has been focusing on this “AI” nonsense between Microsoft and IBM, but all it will ever do is cost IBM money.



IBM decided to throw away an actual product, and company, that it spent a considerable amount of money acquiring, in the garbage, and pivot to running like some idiotic San Francisco cash furnish with an account at the Bank of Silicon Valley.



It will not end well for them if they proceed.



Recent Techrights' Posts

EPO Workers Point Out that the EPO is Destroying the Planet Under the Guise of "Hey Hi" (It Also Grants Many Invalid Patents Illegally
On 12 March and 16 June 2025, staff representation met with the administration in the Local Occupational Health, Safety and Ergonomics Committee (LOHSEC) in Munich
How the European Union (EU) Fell Out of Love With Free/Libre Software
Lots of bribery
Certificate Authority Let's Encrypt Has Almost Gone Down to Zero, Nearly Totally Extinct in Geminispace, the Few Capsules Still Using It Are Spam/Dead/Stagnant
This represents another decrease for Let's Encrypt; the last decrease was last week
Trying to Silence Techrights Was a Huge Mistake
Peter Thiel attacked a publisher for asserting, correctly, that he was gay. Now everyone knows it.
 
Links 08/09/2025: Burger King Cracked, Cox v. Sony Analysed
Links for the day
Gemini Links 08/09/2025: Socialist Computer Museum and GAFAM/ByteDance/TikTok-Dominated Net
Links for the day
Links 08/09/2025: Tim Crook Disappoints Apple Faithfuls and Zuckerberg Lies (Financial Fraud) for Cheeto King
Links for the day
Turn Off Microsoft's Restricted Boot ("Secure Boot")
We're still running a series on this issue
Social Control Media Sites Have Become Bot Farms (Not Limited to LLMs and Automation)
linkedin.com was nothing but trouble and losses for Microsoft
Deep in Debt With the Magnitude of Losses Quickly Growing, Microsoft "Open" "Hey Hi" Now Uses Broadcom for Vapourware, Pretending It'll Do OK Next Year
At some stage it'll collapse
You Can Tell Microsoft is in Trouble When Its Own Fans and Staff Blast it
"Microsoft sinks billions into chasing artificial intelligence fads to hype up its share price."
Multiple Undersea Cable Cuts and We're Still OK
Microsoft customers experience problems
Lawyers Who Think They Are Online Assassins Don't Deserve a Licence to Operate
they've become a laughing stock in their "sector"
Microsoft Windows Fell to 3.9% "Market Share" in Bahamas
Based on statCounter
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, September 07, 2025
IRC logs for Sunday, September 07, 2025
Gemini Links 07/09/2025: Scanner, Slop, and Chadobear
Links for the day
The UEFI 9/11 is 3 Days Away
Nobody denies that bad things will happen
Google Versus Journalism
Google played a big role in the demise of news sites
Gemini Links 07/09/2025: Advertising, Decentralized Archival, and Outsourcing to Bezos
Links for the day
Not Much Left in News Cycles
To be very clear, this does not describe "Linux" anything; it's true in just about every facet of news, except the paid-for fake "journalism" about "hey hi" (sites getting paid explicitly to maintain or rekindle hype)
Throwing Away "Old" Computers (Mozilla and Other Climate Deniers)
Mozilla is not leftist
The UEFI 9/11 - Part VIII - Denial of Service and Selling Us WSL (Windows) Instead of "Risky" (Prone by Breakage by Microsoft) GNU/Linux
Restricted Boot (so-called 'SecureBoot') does not improve security. It is nothing but trouble. It's meant to trouble non-Windows users. In dual-boot setups, SecureBoot is a recipe for disaster because Microsoft keeps erasing or tampering with the boot sector, to paraphrase an associate
Slop is Extremely Rare in Geminispace, Slop Images Are Unheard Of (Despite Images Being Supported)
As long as Geminispace grows in terms of domains it's safe to predict the protocol will still be used in 2029 and hence Geminispace will turn 10
Links 07/09/2025: Robodebt Class Action, Fines, and Copyright Settlement
Links for the day
Links 07/09/2025: Yle Impersonated in Social Control Media, Boat-Attacking Orcas, Midjourney Sued Again
Links for the day
Slopwatch: LinuxSecurity, Linux Journal, and the Serial Slopper
Google won't tackle the issue because Google participates not only in relaying slop but also in generating lots of it
Links 07/09/2025: Google Fines in EU and "Your Internet Access Is at Risk"
Links for the day
Gemini Links 07/09/2025: Little Brother and Corporate Theatre
Links for the day
Links 07/09/2025: More Harms of Slop and Anthropic's Nightmare Scenario (Huge Legal Liabilities for Slop)
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, September 06, 2025
IRC logs for Saturday, September 06, 2025
Microsoft Sites Now Talking About September's Mass Layoffs at Microsoft
It's noteworthy that even Microsoft's MSN now covers the latest revelations about mass layoffs
Gemini Links 06/09/2025: SpellBinding Moving and "The Cloud" Ridiculed
Links for the day
Slopwatch: On "the Apology Industry", Chatbots (Punchbag for Customers), and Fake Articles About "Linux"
"news reporting priorities changed"
Links 06/09/2025: "Covid Incidence on the Rise" and Many Attacks on the Press Worldwide
Links for the day
The Register Bill
The Register MS - putting the "MS" in your centre of the universe
Analogies for "Memory Safety" in Rust
Don't worry, it's Rust! It can do anything!
Nobody Denies That SecureBoot Will Cause Problems After September 11
Not even Microsoft
Gemini Links 06/09/2025: Infinite Scrolling and Posting from Emacs
Links for the day
Links 06/09/2025: GitHub Meltdown Over Slop, "U.S. Jury Says Google Should Pay $425 Million in Privacy Lawsuit"
Links for the day
Despite Its Severe Financial Problems Gnome Foundation Inc Paid Rosanna Yuen Over 100,000 Dollars Last Year
maybe relocation should be considered
The "Left" and the Right"
It poisons everything
Mozilla and Rust Are Not Leftists
they're part of the mass consumerism machine
Disposable to Microsoft
There is an extensive set of people who got used by Microsoft, only to be thrown away a month later or a year later or a decade later
The UEFI 9/11 - Part VII - This Coming Week Many PCs Will Refuse to Boot "Linux" (Because of Microsoft's Expired Certificate)
The real solution is, disable "secure boot" or "SecureBoot" while it's still possible. [...] Just like submarine patents, a lot of this problem was "hibernating" for a while
The Thing Nobody in Red Hat Wants to Talk About Openly
There is a real sentiment or worry among Red Hatters, Europeans and Americans in particulars (because of higher salary expectations)
Slopwatch: Small Parade of Fake News About "Linux" and Scams Borrowing the Name (or Word) "Linux"
In practice, LLMs are a risk
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, September 05, 2025
IRC logs for Friday, September 05, 2025