Re: CTI heads-up

On 7/4/26 11:22 AM, Alexandre Oliva wrote:
> A couple of days ago there was apparently some severe mishap in the
> service we're being told to pay for and to trust infinitely because
> they're expected to be so much better than what we have now.
> https://lwn.net/Articles/1081015/

Thanks for reviewing CTI-related issues and updating the list,
if there are serious issues I'd like to know about them.

Why do you consider a mirror update issue without data loss a
"severe mishap?"
  
> Even the ETA for the fix seems to have been way off.
> https://social.kernel.org/notice/B7viUNMy1UsGX9pwHY

They were transparent and provided updates via an incident
report process.

The issue was identified on July 2nd, and within 3h the mirror
sync was in progress with files being updated as they were
synchronized. If the sync is still in progress it might be that
there are still files being transferred (long tail).

> I'm sorry for their woes, but this doesn't inspire confidence.

I disagree, they were transparent, moved to fix the issue,
provided updates and corrected the issues.

> If such a thing happens to their most important project, and keeps
> security fixes off their front page for so long, what can we reasonably
> expect for our packages?

Exactly the same transparency, correction, and updates.

-- 
Cheers,
Carlos.