> They do have an incentive: patches against upstream need to be maintained You are right. However, this only means they have an incentive to push patches to u

> They do have an incentive: patches against upstream need to be maintained You are right. However, this only means they have an incentive to push patches to upstream _in hindsight_. That's is better than nothing, but still happens after the fact, when the damage is done and the defect distributed to the users. As far as I know, they have no incentive to _wait_ for their patches to be included in upstream. > many [...] maintainers will strongly oppose including distro-specific patches in their packages without a very good reason. Well, fixing security issues is often seen as a "very good reason", completely ignoring that an incomplete and/or errorneous security fix may do more harm than good, and meanwhile provides the users with a false sense of security.