It's unacceptable to sit on a privacy affecting bug like this for 15 months.

This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing:

1. Nothing to get the devs of that library to fix it

2. Nothing to fix the library themselves

3. Nothing to warn their users

4. Nothing in their local application to protect their users.

This is not how secure development works.

For ends users, that's a distinction without a difference. Programmers are responsible for their choice of dependencies. If you've chosen to depend on it, it becomes your problem. Chromium is open source, no? So the email client programmer can fix that bug himself.

On another note, TFA talks about a "GNOME toxic development culture", which looks like a blanket statement. Does it really exist?

PS: I'm thankful that they don't use that thing from Google.

That's a non-sequitur. Just because it's common does not mean it's okay.

PS: If your E-Mails are stored on an Exchange-Server (or: worse Azure) the discussed problem is the least issue.

You are looking for a minority of a minority of a minority - People using Linux, people using an email client, people using Linux that want all the MS Exchange features.

Tons of "general" email clients out there, sure, but you're talking about a largely proprietary system.

Off the top of my head: you could broadcast it more publicly that there is a known issue (particularly important if this is a security issue). You could change code to avoid whatever kernel features trigger the race. You could print a warning if you detect the kernel version is an unpatched one and/or has Kconfig in whatever state exposes the issue.