Im well aware what they're doing, as I submitted this nearly 2 days ago https://news.ycombinator.com/item?id=34605980 https://news.ycombinator.com/item?id=34605

Im well aware what they're doing, as I submitted this nearly 2 days ago https://news.ycombinator.com/item?id=34605980 https://news.ycombinator.com/item?id=34605980 Charging money isn't explicitly against the GPL, BSD, or similar FLOSS licenses. However, are they doing what's required of them with the licenses they're making changes to? Better yet, are they submitting these fixes to the package maintainers to fix? What would happen if *I* get this Ubuntu Pro Plus Super crap, and download source, diff it, and submit the diff? Better yet, now that Ubuntu has a fiduciary reason to slow down updates/fixes to Universe, are they going to impede package security fixes and updates, as it now hinders their revenue stream? > As explained, this isn’t what they’re doing at all. They’re putting their own patches in, not withholding upstream patches. As explained, Ubuntu is providing knowingly security-vulnerable software, and then as an upcharge offering their own custom fix. There's plenty of ways to handle this, some better and some worse. They chose worse. > If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better. Again, they flagged vulnerable software. They could have emitted a message via APT to warn of a security incident with said software. Or they could remove it from the repo until fixed, or hide it behind a flag with apt. They instead chose to keep disseminating it, and then gatekeep their fixes.