Looks like Canonical is trying to sell me security updates I would be getting for free on Debian.
Debian 12 likely isn’t that different, but I don’t want to follow a Debian 11 setup guide then run into issues.
This has always been the case with Ubuntu. Ubuntu only ever supported its main repository with security updates. Now they offer (paid) support for the universe repository in addition, which is a bonus for Ubuntu users, as they now have a greater selection of packages with security updates.
If you don’t opt-in to use Ubuntu Pro, nothing changes and Ubuntu will be as secure (or insecure) as it has always been. If you disable universe and multiverse you have a Ubuntu system where all packages receive guaranteed security updates for free.
Please note: I still don’t recommend Ubuntu due to snapd not supporting third-party repositories, but that’s no reason not to get the facts right.
Debian has always been the better choice if you required security updates for the complete package repository.
Personally I have my doubts if Debian actually manages to reliably backport security updates for all its packages. Afterall Eclipse was stuck on version 3.8 for multiple Debian releases due to lack of a maintainer …
Because the updates are not anyone “trying to sell me security updates I would be getting for free on Debian.”
security updates I would be getting for free on Debian.
Debian contrib doesn’t get official security updates, the same as Ubuntu universe. https://www.debian.org/security/faq#contrib
In both Debian and Ubuntu, only the main repo gets official security updates for free. Ubuntu has a paid option for universe whereas Debian doesn’t have that option and relies on the package maintainer to provide any updates.
I’d still recommend Debian over Ubuntu though, for various reasons.
Definitely on Debian, and I think on Ubuntu too.
Package maintainers can be slow to update packages though. Debian have a separate security team that get patches out ASAP, and those packages go into a separate security repo. I imagine Ubuntu does the same. It’s that security team that only deals with “official” packages, meaning anything that’s not in contrib, non-free, or non-free-firmware.
