home automation server that doesn’t connect to the internet?
Well if uses wireless connectivity with either range broader than your place or is connected to a device that is itself online it can still be a risk. Sure it’s very VERY specific but scanning techniques also improve.
part of the reason to use Debian is it doesn’t really need to be updated, at least not very often
Can I introduce you to OpenBSD where we measure uptime in years?
It needs to be updated at least several times a year…
depends on your use case
home automation server that doesn’t connect to the internet? nah
media server that only occasionally gets connected to the internet? maybe
anything else that regularly connects to the internet, definitely
Well if uses wireless connectivity with either range broader than your place or is connected to a device that is itself online it can still be a risk. Sure it’s very VERY specific but scanning techniques also improve.
You should install updates regardless
if it’s working and there’s no security risk, why?
(I mean, I actually agree with you, I update even normally airgapped machines because them not being updated feels wrong)
Software these days will always need security patches
What’s more is that the longer you put off updating the more things will be changed when you do end up updating.
Even if there are no security risks to mitigate, updates can bring bug fixes and, god forbid, new features once in a while.
New features on Debian isn’t something that would make it into the repository. Bug fixes might but only if security relevant.