One of the packages in the article I linked above was Wordpress, which is not exactly low volume. I work on the Jupyter&#x2F;IPython notebook - we found a security bug last summer, got a CVE (CVE-2015-5607), issued patches... and the version in Debian unstable hasn&#x27;t been fixed, seven months later.<p>If distros can&#x27;t do security maintenance for the software people use, claiming that they shouldn&#x27;t use that software at all is no kind of an answer.