4 ms·

The end of the Red Hat security-announcements list

61 points by rascul 3y ago

client4 3y ago
Rocky Linux should go beyond Centos 2 and become Redhat 2.
ComputerGuru 3y ago
Link seems to be more about the future of LWN security roundup emails than about actual RHEL security announcement emails (the article is really just the headline). Still an interesting discussion to observe and deduce from.
Woodi 3y ago
Red Hat solarization continues...
- yjftsjthsd-h 3y ago
  Isn't it the opposite? Sun was proprietary but opened up in their waning years, while RH was open and has progressively gotten more closed.
  - Woodi 3y ago
    I was more pointing progressive degeneration of functionality then some law. You can call it "ibmisation" too - most likely in the end it will be just another dead [sub]brand.
gbraad 3y ago
They will be published as: https://access.redhat.com/security/data/metrics/rhsa.rss https://access.redhat.com/security/data/metrics/rhsa.rss and https://access.redhat.com/security/data/csaf/v2/advisories/ https://access.redhat.com/security/data/csaf/v2/advisories/ Note: title should be 'the end of the security-announcements mailing list'. Which is outdated tech anyway...
- gbraad 3y ago
  Someone grumpy downvotes the truth.
- yjftsjthsd-h 3y ago
  > Note: title should be 'the end of the security-announcements mailing list'. Which is outdated tech anyway... Yes, mailing lists are clearly out of date; you can tell because they're widespread and actually work, so obviously they need to be replaced with a mishmash of slightly broken alternatives ASAP.
  - wrayjustin 3y ago
    I realize such sarcasm is less appreciated here on HN. But this eye-rolling response encapsulates my reaction too perfectly. It's also interesting to see RSS touted as a _less-outdated_ solution over email, given the industry has been trying to kill RSS for decades and is far more hostile to RSS than mailing lists.
    - gbraad 3y ago
      With the industry you mean mostly 'Google'. RHEL and most other distros, Firefox (and Vivaldi) and python come with the tools to read RSS feeds. It would be interesting to know how many actually relied on these lists instead of the customer portal or Cockpit/Satellite to be informed about this.
      - wrayjustin 3y ago
        I do blame Google, almost entirely. But it's not just about readers, it's also about the content (publishers). Google Reader's death certainly was the beginning of the end, and it sent shockwaves throughout. Platforms like WordPress kept RSS alive, but then you have major publications that redesign and entirely leave out RSS. Without mainstream reader adoption you have less and less mainstream publishers
        3y ago
seabass-labrax 3y ago
TLDR: RedHat will continue to provide notifications of security fixes, however they will do so via RSS and a web portal instead of via email. No authentication or subscription is needed to access these.
- miah_ 3y ago
  Notifications For subscribers only. RSS for anybody. The mailing list was open to all.
  - seabass-labrax 3y ago
    No, access is not restricted - here's a URL to their most recent security advisory in the OASIS open standard CSAF format: https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5491.json https://access.redhat.com/security/data/csaf/v2/advisories/2... It does not require any authentication to access.
  - m4r71n 3y ago
    The RSS feed is open to public, so is the errata page on the Portal (https://access.redhat.com/errata-search/ https://access.redhat.com/errata-search/). Subscribing to email notifications requires some sort of account, just like the mailing list did.
  - layer8 3y ago
    Just run rss2email?
  - hulitu 3y ago
    > RSS for anybody. > The mailing list was open to all. So what is the difference between "all" and "anybody" ?
- subpixel 3y ago
  When someone builds a “portal” for their customers they wind up inventing ways of making the customers go there. Maybe this is just a form of that.
deleted 3y ago
[deleted]
jraph 3y ago
For one, RSS is probably more reliable than emails, which has deliverability issues. Of course, they will now have to deal with badly-behave clients that re-download the whole RSS feed each time they fetch updates. I guess they pick their poison.
- cube00 3y ago
  Given everything needs to hide behind a cache layer these days to protect it from DDOS it'll probably be fine.

61 points by rascul 3y ago

Rocky Linux should go beyond Centos 2 and become Redhat 2.

Link seems to be more about the future of LWN security roundup emails than about actual RHEL security announcement emails (the article is really just the headline). Still an interesting discussion to observe and deduce from.

Woodi 3y ago

Red Hat solarization continues...

yjftsjthsd-h 3y ago
Isn't it the opposite? Sun was proprietary but opened up in their waning years, while RH was open and has progressively gotten more closed.
- Woodi 3y ago
  I was more pointing progressive degeneration of functionality then some law. You can call it "ibmisation" too - most likely in the end it will be just another dead [sub]brand.

gbraad 3y ago

They will be published as: https://access.redhat.com/security/data/metrics/rhsa.rss https://access.redhat.com/security/data/metrics/rhsa.rss and https://access.redhat.com/security/data/csaf/v2/advisories/ https://access.redhat.com/security/data/csaf/v2/advisories/ Note: title should be 'the end of the security-announcements mailing list'. Which is outdated tech anyway...

gbraad 3y ago
Someone grumpy downvotes the truth.
yjftsjthsd-h 3y ago
> Note: title should be 'the end of the security-announcements mailing list'. Which is outdated tech anyway... Yes, mailing lists are clearly out of date; you can tell because they're widespread and actually work, so obviously they need to be replaced with a mishmash of slightly broken alternatives ASAP.
- wrayjustin 3y ago
  I realize such sarcasm is less appreciated here on HN. But this eye-rolling response encapsulates my reaction too perfectly. It's also interesting to see RSS touted as a _less-outdated_ solution over email, given the industry has been trying to kill RSS for decades and is far more hostile to RSS than mailing lists.
  - gbraad 3y ago
    With the industry you mean mostly 'Google'. RHEL and most other distros, Firefox (and Vivaldi) and python come with the tools to read RSS feeds. It would be interesting to know how many actually relied on these lists instead of the customer portal or Cockpit/Satellite to be informed about this.
    - wrayjustin 3y ago
      I do blame Google, almost entirely. But it's not just about readers, it's also about the content (publishers). Google Reader's death certainly was the beginning of the end, and it sent shockwaves throughout. Platforms like WordPress kept RSS alive, but then you have major publications that redesign and entirely leave out RSS. Without mainstream reader adoption you have less and less mainstream publishers
      - 3y ago

seabass-labrax 3y ago

TLDR: RedHat will continue to provide notifications of security fixes, however they will do so via RSS and a web portal instead of via email. No authentication or subscription is needed to access these.

miah_ 3y ago
Notifications For subscribers only. RSS for anybody. The mailing list was open to all.
- seabass-labrax 3y ago
  No, access is not restricted - here's a URL to their most recent security advisory in the OASIS open standard CSAF format: https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5491.json https://access.redhat.com/security/data/csaf/v2/advisories/2... It does not require any authentication to access.
- m4r71n 3y ago
  The RSS feed is open to public, so is the errata page on the Portal (https://access.redhat.com/errata-search/ https://access.redhat.com/errata-search/). Subscribing to email notifications requires some sort of account, just like the mailing list did.
- layer8 3y ago
  Just run rss2email?
- hulitu 3y ago
  > RSS for anybody. > The mailing list was open to all. So what is the difference between "all" and "anybody" ?
subpixel 3y ago
When someone builds a “portal” for their customers they wind up inventing ways of making the customers go there. Maybe this is just a form of that.

deleted 3y ago

[deleted]

jraph 3y ago

For one, RSS is probably more reliable than emails, which has deliverability issues. Of course, they will now have to deal with badly-behave clients that re-download the whole RSS feed each time they fetch updates. I guess they pick their poison.

cube00 3y ago
Given everything needs to hide behind a cache layer these days to protect it from DDOS it'll probably be fine.