Om mensen eens een kijkje in de keuken te geven van een partij die ze waarschijnlijk niet zo goed kennen omdat een ander software bedrijf vaker de media haalt en meer bij de mensen thuis leeft:

https://www.redhat.com/cms/managed-files/rh-2019-risk-report-overview-f21332wg-202003-en.pdf

met daarin onderaan p 6:

"Typically when looking at a specific product, we find fewer vulnerabilities over time as issues get addressed through our security backporting practices (where fewer code changes, which may introduce new issues, are included). We use the term “backporting” to describe the action of taking a fix for a security flaw out of the most recent version of an upstream software package and applying that fix to an older version of the package we distribute. Our backporting efforts enable us to deploy auto-mated updates to customers with less risk."

en uiteraard het bekende goede advies uit de conclusies:

"No control is perfect and protects against every vulnerability. Think holistically about your secu-rity controls, and have layered or overlapping protections in place. Know where your critical data and systems are, and focus your security efforts there for maximum effectiveness. Ideally, you will stop all your attackers, but if not, these blended controls should alert you of some maleficence and allow you to react quickly before the incident gets out of your control."

natuurlijk staat er veel meer inetersante info in het rapport, dus happy reading.