This is also documented in an old 1-page military paper called the "Doctrine of Completed Staff Work"

Even worse is the IBM team trying to sell IBM cloud saying cloud-only is the way to go. Customer agrees and compares clouds, settles on AWS or Azure, then IBM team brings in Red Hat to pitch hybrid.

Maybe I'm missing what's ancient about Fedora or RHEL, care to share?

RHEL 7 came out 6 years ago with Linux 3.10 and is still getting patched. Somebody has to manage and integrate all those security fixes in all those packages without breaking the old codebases.

...it's not just getting patched.

Kernelcare has given me 48 hotfixes on a 3.10 kernel that I booted last year.

    kcarectl --patch-info | awk '/^kpatch-name/{print ++n};{print}'
    ....
    48
    kpatch-name: 3.10.0/proc-restrict-pagemap-access-1062.patch
    kpatch-description: Restrict access to pagemap/kpageflags/kpagecount
    kpatch-kernel: 
    kpatch-cve: 
    kpatch-cvss: 
    kpatch-cve-url: http://googleprojectzero.blogspot.ru/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
    kpatch-patch-url: 

    uname: 3.10.0-1160.25.1.el7

Is "kpatch" there actually the same thing as RHEL's kpatch? I thought Kernelcare used something proprietary.

The Kernelcare front end tool is kcarectl.

Ksplice (Oracle) was first, followed by kgraft (Suse), and kpatch (RedHat).

According to the article below, kpatch is x86/64 only, uses ftrace, provides runtime patches only until the next minor kernel release on a standard license, does not address all CVEs, and cannot be used with "SystemTop or kprobe."

"KernelCare has no such limitations."

https://blog.kernelcare.com/competitors/kpatch-overview-of-e...

I asked because the listing said "kpatch" in the output of the command. I've never used Kernelcare, only suggested investigating it, despite it being proprietary.

Ksplice was done by MIT students, not Oracle. I used it long before Oracle bought it, initially with my own patches (and actually after that as a "legacy" customer). kpatch isn't just x86_64; it's in at least ppc64le RHEL 7, although not for the "alt kernel" on the POWER9 systems I use.

I don't know whether it's the case, but their comparison rather suggests Kernelcare is based on Ksplice.

+1 for KernelCare.

Actually, POWER9 RHEL7 has Linux 4.x, where x depends on the minor release -- unfortunately not the latest on the system I use. I think aarch64 is similar, but I'd have to look for rpm to check. They need similar attention, of course.

Anyway, RHEL kernels have various features backported to the vanilla version on which it was originally based, not just security patches, which probably makes the job harder. It is a major effort.

Agreed - anyone applying for a job as a data scientist should at least be able to work with SQL.