Re:Distribution packages considered insecure
by viraptor on Monday February 22, 2016 @04:40AM
(#11149650)
You don't have to upgrade every 6 hours. The upstream repo may be constantly updated, but the smaller your scope is, the less you need to care about really. For example I expect that I'll have some new packages on my desktop every few hours, but on a server with system+service+monitoring it may be one package a week instead. At that pace, it's trivial to just get notifications and classify updates as critical/useful/whatever.
If you have a proper test/deploy pipeline you can retest with new software all as it's released, but only push to production every week, or when it's critical.
If I were running a larger company I would assign my security team to help out a distro security team, so I benefit from the work of others as well as getting specific support for the software I really care about.