Pretty sure oracle have made a habit of going after security researchers who use responsible disclosure pathways also.

RHEL also introduced some.... interesting changes few times, like re-enabling ciphers removed from upstreams because their clients needed them for something.

I remember our amazement on how we failed audit on having a cipher enabled in OpenSSH version that had that cipher removed in upstream...

I always have to chuckle a little when git tells me that Azure DevOps is too unsecure to connect to because of a deprecated cipher they still use today :D

Losely related: I've audited so many BSD instances that were using MD4/NTHASH in their passwd and shadow files because they wanted to keep compatibility with their Windows infrastructure... it's stunning to see what is still possible in terms of misconfigurations. Things that should have been removed a long time ago.

The neat thing about RHEL is that there's a single 'crypto-policies' package which configures available TLS versions and algorithms for everything in the system: TLS, SSH, IPSec, DNSSEC, Kerberos and so on.

Regarding SSH, the FUTURE policy removes AES128, HMAC-SHA1 and DH Group 14.

But Oracle did manage to make Linux unbreakable, so there’s that.