I've known people in authority positions who have insisted on CentOS because "red hat certification", "tested for enterprise" etc, whose first setup step is to enable EPEL and a bunch of 3rd party repos.

They don't seem to see how this negates the advantage of using a "well tested, enterprise grade" distro!

I much prefer Debian (for servers and development machines) as a good intersection between "up to date" and "stable".

Well, epel has extra packages. They are by definition not essential to the functioning of the OS. Why you wouldn't want those from a rapidly updating or rolling-release repo is something I don't understand.

EPEL not being enabled by default I find a little weird, but sure it's not the end of the world.

The thing I find strange is that the people I'm talking about will happily run code from random 3rd party repos (providing PHP 7.0 or similar), and copy/paste repo key fingerprints from the web without blinking, while steadfastly refusing to use an OS with such packages included and tested in the official repos "because security/quality/enterprise".

Agreed on the third party repos, but EPEL is fine. Fedora/EPEL, while unsupported, is a Red Hat project. It's basically the upstream release for RHEL, and many Red Hat employees contribute. They have a really good QA process too.

EPEL is a must. Also I'm using official nginx and postgres repositories for latest releases. Never used other repositories.

If you want to run the latest, greatest, bleeding edge version of $foo, CentOS may not be for you.

Well, I noticed that CentOS/RHEL distro's have quite old versions of everything, but Debian stable doesn't seem all that cutting edge either. I find myself reaching out to backports and even sid to get what I need at times.

At my new job, we recently had that debate -- and I was quickly overruled for recommending CentOS/RHEL. My employer is a Java shop, I can almost always find rpm and deb pkg's for most stuff we need.

RHEL works by backporting bug fixes and new features into the old versions. Don't go by the version numbers, check the availability of features instead.

Backporting features and not bumping versions is redicilous though, especially when that means v3.1 of upstream is different to v3.1 in your repo.

You're just not their target audience. Others are willing to throw money at Red Hat for this "rediculousness", though.

RHT's market cap is over $20 billion today so that says it's providing real value to customers.

FWIW, you can find newer versions of some software packages via "Software Collections".

And neither is Debian (stable). But given that they're often used for the same purpose (servers), it's not that irrational to compare them. Having a larger, supported package selection (even if it's a bit old) may be a good thing, and relevant when you choose your distro.

For the record: I have no idea how the package selection compares between CentOS and Debian - I've been firmly in the Debian camp since forever, and stay there mostly for other reasons, of which laziness is the most important one.

It's not just the latest. Debian stable doesn't have the latest but it does have a larger selection of official packages.