> The "balkanized" downstream has been working quite well Disagreed. > The only major issue was the OpenSSL fiasco that was due to overpatching upstream Ther

> The "balkanized" downstream has been working quite well Disagreed. > The only major issue was the OpenSSL fiasco that was due to overpatching upstream There's a reason OpenSSL got forked as LibreSSL/BoringSSL - even downstream realized their approach wasn't cutting it, and they needed to go upstream and start burning everything down with fire. Granted, OpenSSL has been getting their act together - so perhaps unforking might be warranted? Meanwhile, the CVE database continues to be flooded with memory vulnerabilities. Distros dutifully push out the patches when they get them, but that's the bare minimum.