For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on `cron-apt`, `apticron`, `unattended-updates`, apt cron jobs, etc. that download and/or install security updates as they are released.

It seems like there are two philosophies on this:

1. Download all security updates and notify with an email, and then have an admin come in and manually apply the updates.
2. Download and install all security updates as they are released, sending an email notification letting the admin know what packages were upgraded.

For these two cases, what is the recommended way to configure automatic security upgrades on a Debian server?