zlacker

>>natebc+(OP)
It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

>>troad+P8
Debian stable. If you need something to be on the bleeding edge install it from backports or build from source. But keep most of your system boring and stable. It has worked fine for me for years.

>>workso+5b
As long as you do regulary updates of your debian stable, you are not secured against supply chain attacks.