I thought about this issue some time ago:<p><a href="http:&#x2F;&#x2F;security.stackexchange.com&#x2F;questions&#x2F;109026&#x2F;security-updates-foss-upstream-policies-how-are-they-chosen" rel="nofollow">http:&#x2F;&#x2F;security.stackexchange.com&#x2F;questions&#x2F;109026&#x2F;security-...</a><p>I agree that there&#x27;s a distinction to be made between core&#x2F;base and user-applications&#x2F;ports (as mentioned elsewhere in this thread)...<p>Ultimately it&#x27;s all softare, and the only distinction is fuzzy: e.g. the kernel won&#x27;t easily break backwards compatibility, while databases, interpreters, etc. will... but it&#x27;s not something you can easily measure without being vigilant for every change.<p>I think that an important distinction (at least for Ubuntu) are the main and universe repositories: I&#x27;d expect these problems to happen in universe and to be mostly absent in main.<p>From this point of view, a good choice would be to completely rely on main, and to weights pro and cons when deciding if using the repositories to manage your user applications&#x2F;libraries&#x2F;dependencies for your actual service. (I&#x27;d probably define all of them with Nix, but that&#x27;s not a panacea)<p>The problem is that even main is guaranteed to keep up with all the security updates: In some cases updates aren&#x27;t prepared and shipped because the default configuration is not vulnerable (but obviously a sysadmin could change that) and it&#x27;s not worth the effort.. or just like in the Python2.7.9 case: A security update most often can be applied as a standalone patch, but if the changes are overarching and not easily distilled into a patch, the update will be too expensive&#x2F;risky and won&#x27;t be done.