This reminds me of something I saw online maybe 20 years ago now. Someone created a torrent with a name like “every IP address ever (hacking tool)” and uploaded it to Suprnova, which ended up having thousands of people seeding it. It was just a text file with every IPv4 from 0.0.0.0 to 255.255.255.255 😂
No. All the official packages in the main repo get security updates from the Debian security team.
Only the packages in contrib, non-free and non-free-firmware don’t have official security updates and rely on the package maintainers. These are not considered part of the Debian distro, and I don’t even have them enabled on my servers.
Out-of-the-box, Debian only enables the main repo, plus the non-free-firmware one if any of your devices require it (e.g. Nvidia graphics, Realtek Bluetooth, etc). You have to manually enable contrib and non-free, and by doing that, it’s assumed you know what you’re doing.
In the case of non-free and non-free-firmware, they can be closed source software (like the Nvidia drivers) or have a non-open-source license that doesn’t allow distributing modified versions. In those cases, the Debian team is unable to patch them even if they wanted to.
GoOn (programming.dev)
Yes, Ubuntu Is Withholding Security Patches for Some Software (www.flu0r1ne.net)