[kosolam]

It’s a shame that after so many years and so many distributions the community could not come up with a good model for a low maintenance secure distro. IMHO the author of this post is surely the kind of people that eventually only care about their job security and just stir the water without making any progress…

[SAI_Peregrinus]

"Low maintenance" and "Secure" are contradictory goals.

[kosolam]

Maybe that’s the point of the author. But I completely disagree.

[SAI_Peregrinus]

If programmers could write secure code from the start, then security updates wouldn't be needed.

Years of experience have shown that programmers can't write secure code from the start. Maybe some day we'll have languages & tools that allow for network-connected programs that never need security updates, but today is not that day.

Attackers often exploit vulnerabilities reasonably quickly, so updates have to happen soon after vulnerabilities are discovered.

So we need timely updates, and we keep needing updates. Unless we define "updating software" as not contributing to maintenance, I'd say my point stands.

The maintenance is made even harder for distributions like Debian that want to backport security fixes without backporting feature changes or other refactorings. That produces a lot of extra work for the maintainers, and those maintainers aren't usually as familiar with the code as the authors further increasing the maintenance burden.