I did that for a while but keeping images up to date was a chore I’d often forget to do then regret not doing once I needed it. Sure I could probably automate it with a little effort but instead I switched to this service and have been running with it for a few years now without any issues.

While I know there is a risk involved, pragmatically that risk is very low given I’m just an anonymous individual very occasionally using this for personal devices.

You can actually run this service locally though. I did contemplate running their Docker container on my home server. However I use it so infrequently that even running their Docker container locally felt like an unnecessary additional piece of work.

I've found it convenient (once setup...) to run internal package mirrors.

These with even relatively dated 'netinstall' media can provide you with current installations. Then provide you with super fast updates.

I'm more familiar with doing this with RPM based distributions -- CentOS, Fedora, etc. It's basically a web server and rsync behind a [parameterized] systemd timer so you can centrally control existing/new mirrors

The results can admittedly be a little funny. If the netinstall is so far behind that RPM doesn't know what to do with the new packages, then yea - time to get a new one :)

That was the issue for me though. It would often be years between usages since the only time I needed it was when a computer stopped booting or I was repurposing a device. Neither being things that happens very often.

Aye, that makes sense. It's hard to justify if you don't leverage it often

I moved and I've been hard pressed to bother booting everything up and checking on it, and I have quite a lot of devices to manage

The risk wouldn't be someone deliberately targetting you: the risk would be someone deciding that this is an excellent vector to gain backdoor root access on many random machines.

I wasn’t suggesting I would be personally targetted. I was stating that the infrequency and low criticality of my usage vastly narrows the risk of getting exposed to the attack.

Hence my point that if I were using this regularly then I might want to invest in a more secure mirror. But when it can be years between my usages the benefits of self hosting are vastly outweighed but the cost (both in time and electricity) of managing it. Thus I’m willing to take that slight risk in this specific instance.