Security Support - Re: Let's Discuss Interim Releases (and a Rolling Release)

[Scott Kitterman]

On Thursday, February 28, 2013 05:49:46 PM Martin Pitt wrote:
> Marc Deslauriers [2013-02-28 11:29 -0500]:
> > The security team does support the development release. When we push
> > updates for the stable release, our policy is to either sync, merge or
> > fix the packages in the dev release also.
> 
> That has been my impression as well. I would think that often this
> should be the easiest case, as often it just means a sync or even
> autosync.
> 
> > We will also be pushing urgent security updates to monthly snapshot users.
> 
> So if the "last monthly" is supposed to actually be a kind of a
> release, instead of just a blessed daily installation image, this
> would mean that there would be a new series each month?
> 
> I would expect users to upgrade to the latest packages of the RR each
> time update-notifier pops up, regardless of which medium they used to
> install. After a month this needs to happen anyway, so why not right
> away?

I'm probably in the minority, but I actually read the USNs and consider when 
to apply them.  As an example, when I'm traveling and only have my laptop 
available, I only apply updates that are important for security reasons that 
are relevant to my situation.

Scott K