Security backports for the Drupal LTS concept

I think backporting security fixes is a good first step to make older drupal versions more secure.

If it's possible to integrate in the main security process especially for reporting security problems and announcing fixes we should do. If not we need an own system for that.

I think the biggest problem is to create strategies and getting more manpower to handle LTS. The integration of a robust LTS concept in drupal.org should be a part of the normal improvement like the current GIT Migration.

Greggles is right.
This topic is being brought up from time to time over the past years.
I was (once) too looking for ways to make a LTS version of Drupal work.
I too think it stinks that such a solid framework is loose sand when it comes to lifespan.
The reaction I got several times: "He, Drupal is free, we cant support more than 2 major branches, pay for it if you want a third to be maintained".
Understandable. But, paying for maintainment of an older, or LTS branche isn't realistic. Who to pay? You have to have ALL people maintaining core- and popular 3th party code to be willing to support this, payed or not.
This cannot be done from the outside. The initiative have to come from the core team and key community members, top down.

Drupal developer Nederland

Given that the idea of Drupal LTS without support of any of the active development core is contrary to the official policy (and thus not feasible in real life)...

how about the LTS effort be simplified to just focus on announcing the problems for people who choose or have no choice to stay on the older versions. The reality of how it works right now is that only one group of people are well infromed about these vulnerabilities, and these are the blackhats, hackers, and spammers out there. While those people who are the legiitimate site owners or operators just stuff their head into the bucket of sand and hope nothing goes wrong with their site which previously was patched up. Given the fact people just two years ago were forced to develop in drupal 5 because of the lack of contrib modules for d6, this is a pretty crappy situation.

Given that a "real" LTS effort with backports and testing is unlikely to ever really get off the ground, perhaps those interested in contributing and who are still stuck (for whatever reason) with these old "ticking time bomb" sites can at least inform one another of what is vulnerable. That way site owners/operators can make an informed decision about what unpleasant compromises to make (for example "uninstall panels".... A bitter pill to swallow for sure if you spent $50,000 on custom panels development!)

What I propose is we just list the security vulnerabilities from drupal 6 or 7 that are also found to be in drupal 5. Even cursory comparisons of what changed in the patch fixing the security problem can allow you to identify if the same code exists in the same format in Drupal 5.

I think it's a more realistic goal to accomplish, instead of saying "gee i guess that can never happen" and letting the blackhats win by default. In some cases, backports might result, which would be a good thing too. (For instance, what if a critical CCK bug comes out. Every drupal 5 site in the world is not going to uninstall cck).

Some general thoughts about this issue as a whole... Drupal as a community just shunning the old versions like they are black sheep in the face of such problems (not if but when they occur) is not to the benefit of the community. Drupal the movement has grown exponentially in the last couple years. this is good, and very exciting for everyone involved. However to keep this momentum, we have to not totally screw over everybody 2 years (?) from now when Drupal 6 is suddenly declared obselete. My point is that this problem is only growing worse, as drupal gets more popular. I believe proper education at the outset, and responsible site building by development shops is the solution. All developers should make their potential clients aware of the issues surrounding a modern CMS website, which is that you are going to have to pay a bunch more (maybe evne more than you did for the first version) to upgrade the site + all its content baggage when it expires. It is bordering on criminal irresponsibility in my opinion to not educate customers on these facts first, before sealing the deal to build their site. But I am bitter sysadmin guy, so of course I think that. :)

Tyrell: Would you... like to be upgraded?
Batty: I had in mind something a little more radical.
Tyrell: What... what seems to be the problem?
Batty: Death.
Tyrell: Death; ah, well that's a little out of my jurisdiction. You...
Batty: *I want more life, father!*
- Blade runner, 1982