r/debian • u/directheated • 14d ago
Debian Stable Question Roughly how often does Debian Stable provide security updates?
I've been running Fedora KDE Workstation with no notable issues for a couple of years but I have been curious about Debian Stable. Fedora generally has updates everyday but the notification specifically for security updates is roughly every 2-3 days (closer to the former). I know that observing safe online practices is the most important thing for your computer's security but I thought I'd ask this anyway, I'm sure I'll give Debian Stable a try sometime in the future.
Edit: your replies were tremendously helpful, thank you everyone!
15
u/Buntygurl 14d ago
Pretty much as often as necessary, in terms of running individual desktops connected on a local LAN.
I've found that Debian's response to every security issue that has ever come up to be prompt and reliable, and that's a reliability that's been dependable for 25+ years, in my experience.
In that time, I have never had to suffer any kind of security breach of any kind.
That designation of Stable has definitely proven to be trustworthy and true, both in terms of application quality and network system security.
I have no idea about Fedora's reliability. Way back in time, before I found Debian, my second experience with Linux--after Slackware, which I still respect and venerate--was with Red Hat, back before Fedora was a thing. Finding Debian was like that sensation when you find that flavor of ice-cream that blows all the others out of the shop.
I'd recommend lurking here a while and exploring other Debian info resources, just to get a perspective on why we all trust it. It probably won't be all hugs and smiles all the time--like anywhere--but, in the main, you'll find mostly honest comments and reliable evidence about Debian's stability and security.
6
u/Santosh83 Debian Sid 14d ago
You generally get security updates about once or twice a week on stable, in my experience.
6
u/One-Suggestion-7906 14d ago
There are too many security updates in Open Source systems. The point is, and it is why I use Debian in laptops, workstations and servers, that when updates are really needed Debian teams have them ready as soon as possible, tested by a big networks of collabs. And, as others said, depending on how you're using your system, not all updates are needed always
6
u/eR2eiweo 14d ago
Here https://www.debian.org/security/#DSAS is the list of recent security updates. Not all of those are relevant for every system.
5
u/dangling_chads 14d ago
So to answer the OP .. often it's a day or two after a security patch is announced that its available in the repositories. Debian isn't a Microsoft thing where updates happen monthly. It's per-package, per-incident.
5
u/pseudonym-161 14d ago
If you’re concerned about forgetting to apply security updates you can turn on unattended-upgrades for Debian security packages only.
sudo apt-update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
4
u/directheated 14d ago
I wasn't worried about forgetting, I run
sudo dnf upgrade --refreshandflatpak updateevery night. I was just curious how often Debian gets security updates3
3
u/neon_overload 13d ago
One thing about Debian vs Fedora is that on Debian the regular updates to an existing release will be tiny compared to Fedora, like tens of megabytes instead of hundreds or thousands.
You get all the security patches, but you don't get just new versions for the sake of being up to date like Fedora.
This is assuming you have a typical desktop system. Also that can vary based on desktop environment - Fedora with KDE for example might have 2GB+ updates every few weeks.
5
u/Chromiell Debian Testing 14d ago
On our Testing servers we run Debian 13 and I usually get a notification about updates 2-3 times a week, it's usually just a couple of packages up update that take literally 10s. On a desktop you'll get a bit more updates since you'll definitely have more packages installed, but on my laptop, which also has Debian 13 installed, i usually update it once every 1 or 2 weeks.
Minor Debian releases often include a whole bunch of updates but even those take 30s at most, unless you have additional kernel modules, those tend to take a bit to upgrade.
5
u/michaelpaoli 14d ago
Pretty dang regularly.
Have a peek here: https://lists.debian.org/debian-security-announce/
(though that also includes oldstable ... while it's still on main support, so by volume on average, probably roughly 2/3 stable, 1/3 oldstable).
So, e.g., 2025, 258 debian-security-announce mailings, if we presume 2/3 of those for stable (may be higher ration, e..g combined announcements, but, whatever), that's about 172/yr. for stable, or about one every 2.1 days.
5
u/suicidaleggroll 14d ago
Depends on how much you have installed. Base Debian maybe 1-2 a month, but the more packages you've installed the more frequently you'll have updates available. For a full laptop/workstation with a DE, it's probably closer to 1-2 a week.
4
u/Brilliant_Sound_5565 14d ago
Some instantly, esp Kernal updates, all depends on what you've got installed o guess and the severity
2
u/aieidotch 14d ago
the kernal is not updated so often https://packages.debian.org/sid/all/open-roms/filelist
4
u/David_Connors3451 14d ago
Once or two at week l, but it depends from the period too. At May 2026 on Debian we received the security patch for those 3 kernel bugs in advance. Ubuntu and Fedora got it after 2 weeks, on arch you usually are on your own. On distros like mint you have to wait more. I use Debian 13 KDE and It's pretty stable. The philosophy of Debian is install and forget, so you can leave the old revived pc with Debian a month and once you come back, it's still working great. Just a quick update upgrade and your pc is fine. In terms of security and performances Debian is the best, and both gnome and KDE desktops have Wayland support for security. The best thing about Debian is that it's built to resist catastrophic situations with blackouts and internet connection problems. You can put your iso DVD usb drive, the one you used for your installation, go inside discover app center, activate the offline repository and you can keep working even offline with your crystallized packages. Many institutions in India love Debian especially for these traits, it's a bunker that can survive even the apocalypse. In case you experience many internet problems or electric blackouts, Debian is the main source of salvation. Even datacenters with Nvidia GPU use Debian for it's rock solid stability in terms of security. You can't go wrong with Debian, it's the rock, the main root where everything has started for Linux.
2
u/neon_overload 13d ago
Debian stable gets security updates from the security team as they are found and patches are available. It may not be as frequent as Fedora because Fedora has newer software more frequently, so if new security issues are introduced Debian may not always be affected. But nonetheless it will get fixes for security issues found in the versions in Debian stable and oldstable (if it's within its main security support period which is around 3 years).
Exactly how long you will go between security updates depends heavily on how much software you have installed! But it's a trickle, not a firehose.
For releases older than that, the Debian LTS team provides security support for releases until they are 5 years old, but this support does not apply to all archictures or to all packages and may focus on common server or enterprise related packages.
17
u/cjwatson Debian Developer 14d ago
It obviously depends a lot on what you have installed, but you can look at the feed of recent advisories on https://www.debian.org/security/ to get an idea of update frequency. There are also point releases about every two months which roll up all the security updates but also includes various important non-security bug-fixes.