[ploxiln]

grsecurity offers commercial support, and customer-only stable updates. (Only the latest version of the patchset for the latest linux kernel is available at no cost.) (Of course, if you pay and receive a stable update, you can re-distribute it under the terms of the GPLv2.) grsecurity is not a hobby.

A lot of their work has not been accepted into the mainline linux kernel ... but it's hard for me to see how this is a problematic sort of "not really crediting or even acknowledging". If anything, it pushes people to go to the source, grsecurity itself, for their "hardened" kernels. It seems that grsec/pax do have a lot of recognition as a result.

Yes, the inventors and developers of these hardening techniques want to be praised and have their work immediately used as-is to save the world. But we don't all have to want the same thing, to have the same priorities. We don't all face the same threats, nor performance and feature requirements. If people want to make the various trade-offs in favor of a significantly more "hardened" kernel, they've been free to use grsecurity or openbsd for quite a while. No need to blame linux-mainline maintainers for the people who have not made that choice. There's really no unfair lock-in going on here...

[AstralStorm]

Grsecurity and Pax are ineffective against almost all kernel bugs. They only make a small set of bugs (relying on suitable code) harder to exploit.

Those measures are meant to protect user space, not the kernel.