Your tone seems to suggest that some obligation exists that some obligation exists to do more than share the source to any improvements.
This obligation is wholly and totally imaginary. Its as if someone gave another party an entire farm and in the contract specified that he could eat some of the food that grew from it and that someone threw a fit when the first party walked up and made a sandwich.
Seeing as there is no sane and legal way to require anyone to pay for said patches the reasonable way to fund such an effort is to get the community to voluntarily fund such an effort with whatever platform is most useful preferably in advance.
It seems that they have instead chosen to rely on a mixture of manufactured drama, illegal threats, and general unpleasantness to keep their efforts from being well integrated with mainstream. While this remains so they can offer definable value.
In the long run I predict bankruptcy and irrelevance for a company that few care about now and none will care about later.
I'm having trouble seeing, apart from ignorance or misinformation, why anyone would condone GRSecurity. The code is helpful but you wouldn't want the authors in a position of authority over the operating system of a billion-plus computers.
Right now, most arguments in defense of GRSecurity are simply: "Two sides are arguing, therefore they're both wrong. Aren't I smarter for pointing it out?"
> Their research are in no way 'directly derivative' of the linux kernel. Their implementation was based on linux
This means that it's captured under the GPL, and anyone can do as they like pursuant to the license (which grsecurity has attempted, repeatedly, to constrain in contravention of that license), and that this guy has an a-gen-da and something to sell you.
I don't follow this stuff closely, but I believe that the KSPP was started by Kees Cook because other approaches had failed: grsecurity/PaXTeam had been unwilling to cooperate to get their patches upstream for a long time, so the only way to move things forwards for everybody was to re-implement the functionality without PaXTeam.
This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?
Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.
200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows
200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it.
2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases
2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites.
now: - this mess.
I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways.
Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that.
At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.