In my experience its really bad for your mental health to read the source code of software you use, there is a troubling amount of horrific code in widespread use.

Great that you can cover everything from security to networking in a multimillion LOC project. I guess this is not a average software engineer skillset.

Outside of certain areas - if you manage to reliably reproduce the bug, you're likely to able understand the bug, and it's likely you can fix it.

But sure, there are areas where things can go very wrong. Prime example being the horrible Debian ssh/ssl key gen entropy bug:

https://lists.debian.org/debian-security-announce/2008/msg00...

(note that this was a "bug-fix" introduced after a misguided effort of looking for bad code - so a bit different from the typical "I triggered this bug in normal use").

I took your comment to mean that we shouldn't demand the time of volunteer open-source developers. I agree. But Canonical is a for-profit company.

Unless you are paying them, yourself, can you really expect more from them than from a volunteer developer? Maybe they're quite responsive to their enterprise customers. I, personally, suspect they are. On average that may lead to at least some trickle down gains for non-enterprise users, even if their specific reports are useless and pointless.

Fair enough, although I would expect some sort of loss-leader level of support that isn't entirely useless, if you are to drive enterprise adoption from the bottom-up.