Opinion: the 'perfect solution' is to keep up with upstream and avoid backporting. It takes more work, but it reduces the separation between distro and upstream.

That's definitely not ideal for users, though.

Forced updates every 6 months is annoying to most people. Forced updates every day or so would be annoying to basically everyone.

Running Fedora since I-don't-even-remember-when (around 2008?) and I was never annoyed (unless I try to run CUDA and the like, because they rely on e.g. an ancient GCC etc.).

In particularly it was a significant improvement over the annoyances of Ubuntu, and I am still angry when thinking about the brief period I was maintaining a bunch of servers running Debian. Really unnecessarily difficult - particularly updating/upgrading and trying to clear the mess their systemd approach caused, in particular missing unit files for popular services (I think it was the isc-dhcp-server).

But this means that you are happy to upgrade all of your computer every six months or whatever Fedora's cadence is. Most people are definitely not happy to do so, because updates mean changes to stuff that works, and most people hate it when stuff that already works changes beneath them.

This is of course even worse if you are not the end-user but are trying to ship an appliance to your customers. Why would you want to update the entire appliance OS in the field fo all of your customers just to ship a security patch, instead of sticking with the same base OS on already released appliances?

Hm, let's dissect.

Upgrade schedule for Fedora is twice a year, yes. Goes by without any issues, stuff still works.

There is change and then there is change. Yes, I understand that some things don't need to change, and why do they always have to. Do I need my Desktop to still resemble 3.11 because "Why did it ever change"? - No.

Some things in life simply change and they always have. I try to keep up where change is necessary.

And if I would be shipping appliances to customers, why should I have "forced updates" of any kind outside of my control? I would never sell anything without my own repos, quality control, etc.

Do you seriously sell Debian devices to anyone and support them, if anything outside of your control breaks? I seriously don't understand the argument.

And if I ship software of any kind that relies on some libraries, I have to maintain it, of course. This includes going with the major releases.

If this is embedded hardware, where there simply are only two or three updates in its lifetime, everything is different of course, but how on earth would I then have forced updates from RedHat??

My company actually sells CentOS and Ubuntu based appliances (B2B) and we provide customers with updates (which they can choose to install or not) whenever a security problem is found. But we do NOT upgrade major versions in the field - we try to release our latest and greatest with the latest LTS release, and then provide any updates to that LTS. After the OS support period expires, we work with customers to migrate to the newer version of our entire system, instead of trying to provide further security patches.

Sounds perfectly reasonable.

Why are you afraid of updates then?

> Forced updates every 6 months is annoying to most people.

You aren't forced to update on Fedora. Fedora always supports current release n and n-1. There's even a window when n-2 is still supported after a new n is released.

Even then you aren't forced to update. I work with a guy still running Fedora 29. I wouldn't recommend that personally but his machine still works fine and is rock solid stable. Probably not the most secure though :-P

Your "perfect solution" just shifts responsibility for package maintenance (keeping up with changes) to the end user. Many people use Debian exactly because they don't want to deal with every upstream brainfart.

Eh, upstream is not always the best either. Sometimes they don't fix security issues. Sometimes upstream is very change happy and the distribution will do best by lagging behind "and see what happens".

It takes less work. Just run Debian unstable. That's exactly what it is.