Ubuntu's trust problem in 4 concrete issues - verified facts, no FUD
Strong agree. I use a derivative that blocks snaps instead of direct Kubuntu now, and it wasn’t Just because of the snaps.

I use a derivative

Without Ubuntu Pro subscription the entire Universe repository does not receive any security updates by Canonical:

canonical.com/…/ubuntu-pro-enhanced-security-and-…

You should consider switching to an entirely independent distribution that does not lock security updates behind a paywall, perhaps something based directly on Debian or Fedora.

How Ubuntu Pro delivers enhanced security and manageability for Linux Desktop users | Canonical

This week Ubuntu Pro entered general availability, giving Ubuntu users access to expanded security coverage on top of key enterprise management features. […]

Canonical

Update: Correction. While you do get five years of security updates for Universe on an Ubuntu LTS, those are updates done by the ubuntu community, not canonical. To get Universe security updates from Canonical, you do have to sign up to Ubuntu pro, which can be done without any payment, but as I describe in my original comment, does require creating an account.

While Canonical deserves the criticisms leveled by op (that I agree with), it’s also incorrect to say that they lock security updated behind a paywall.

Anyone that does use Ubuntu gets security updated until they stop supporting that particular release version, which iirc is for six years (I may be wrong, thus is from memory).

If you want extended security updates for a specific version of the os, you can elect to sign up to Ubuntu pro without paying any money. You do have to make an account, and if you so choose you can populate the account info with garbage info and a disposable email, and you’ll get extended security updates for that release version.

While Canonical deserves the criticisms leveled by op (that I agree with), it’s also incorrect to say that they lock security updated behind a paywall.

Anyone that does use Ubuntu gets security updated until they stop supporting that particular release version, which iirc is for six years (I may be wrong, thus is from memory).

I quoted the relevant part and yet you still don’t understand that Universe is explicitly not covered by security support by Canonical without Ubuntu Pro.

you can elect to sign up to Ubuntu pro without paying any money

you can elect to sign up to Ubuntu pro without paying any money

Yes, home users can sign up for Ubuntu Pro for free which means repository access is tracked on an account level. How isn’t this more shitty than for example plain Debian?

Debian also doesn’t offer security upgrades for contrib and non-free.
Only main is officially supported.

Same as Ubuntu, security upgrades for additional repos are handled by the community, not the distro maintainers themselves.

Debian also doesn’t offer security upgrades for contrib and non-free. Only main is officially supported.

So Fedora and openSUSE are most superior. OK.

No, it’s the same with every distro.
Distro maintainers CAN’T support repos containing non-free packages with security fixes.
Because they can’t fix security issues in the code.
Because the code is not free for them to edit.

This entire criticism just shows a lack of understanding of how distros work, and what security updates are.

Ubuntu Universe does not have licensing issues. Ubuntu’s nonfree repository is Multiverse. Universe is just the community- as opposed to project-maintained one
Same thing applies.
The AUR doesn’t get security updates from Arch,
RPM Fusion doesn’t get security updates from Fedora,
Packman doesn’t get security updates from OpenSUSE,
and Slackbuilds/Alienbob don’t get security updates from Slackware.
woelk did make a good point that based on submission processes, Fedora Main is basically their equivalent of Ubuntu Universe, though.

i’m not sure what that has to do with the argument

(curious, though: does the Fedora project even have an equivalent to universe? I also thought that OBS didn’t have security updates just like the AUR doesn’t.)

does the Fedora project even have an equivalent to universe?

No because all FOSS software distributed by Fedora is in the main repo.

Ah. Both misunderstood what you were saying and was uninformed. My apologies. Editing my original comment to reflect that.
Drink your verification can to install security updates.