[staticassertion]

It's the absolute opposite. It's insane that this commit wasn't flagged as a patch for a major vulnerability. Why am I finding out about this now? Why is it now my job to comb through commits looking for hidden patches?

It puts me, as a defender, at an insane disadvantage. Attackers have the time, incentives, and skills to look at commits for vulns. I don't. I don't get paid for every commit I look at, I don't get value out of it.

This backwards process pushed by Greg KH and others upstream needs to die ASAP.

[weberer]

Personally, I just enable automatic security updates and forget about it.