To me the most important point in this discussion is that you have the freedom to upgrade your servers yourself if you want. No one is forcing you to get your updates from Red Hat. If you want to continue using say Red Hat Linux 7.1 after December 2003 and don't want to migrate or upgrade or move to another distribution then you can always roll your own security updates. Or find someone you trust to do it for you and pay them. Or set up your own service where you provide 7.1 security updates for anyone who pays you an annual fee.
We've always had our security updates end of life policy public. Back in December 2002 we altered the policy to make it dependant on dates rather than based on when we come out with newer releases. We got a fair bit of press coverage (and slashdot) about it. http://www.redhat.com/archives/redhat-watch-list/2002-December/msg00008.html Thanks, Mark -- Mark J Cox / Red Hat Security Response Team _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html