I personally consider Ubuntu an irresponsible choice. They hold back security updates unless you subscribe to Ubuntu Pro with the 'esm-apps'. I'd rather use a distro that doesn't apply a ransom to security updates.
If so, why pay for that rather than upgrading? Honest question.
LTS also only covers core OS components with security updates, not the 30k+ packages available in the repo...
And this, among other things, is why I like the agency that small companies should be able to offer you.
IT guy: We must upgrade our shockingly ancient [database|OS|whatever]. The long term support patching costs are $X thousand and we are out of compliance with corporate security policy and they are threatening to deny our exception.
Exec: How much does the new license cost?
IT guy: $Xk + $1.
Exec: Is corporate security going to pay for it?
IT guy: They don't usually do tha...
Exec: No.
IT guy: Bu...but...
Exec: One more word out of you. Just one more word. Fucking try me.
Critical industries are slow to make changes due to risk and regulatory requirements. Spend any time at non-tech Fortune 500 or similar and you'll run into this all the time.
All applications need maintenance. Either you do it at application level to keep on top of its dependencies or you do it at OS/3rd party level. Either way, someone wants to get paid.
Yes, that is the entire point of what I said.
> most stuff these days could probably be shoved into a container and thus extremely distro/version agnostic
It depends on if it's an in-house app or managed and built by a 3rd party (may void contract). Also depends on the risk of life/monetary loss if something goes sideways.
Ubuntu Pro is an additional stream of security updates and packages that meet compliance requirements such as FIPS or HIPAA, on top of an Ubuntu LTS.
---
There are additional patches they are releasing that aren't contributed upstream for either security or compliance features.
... unless you're a Ubuntu Pro subscriber
That's well spelled out here: https://ubuntu.com/about/release-cycle
You can also just upgrade your LTS and continue to get support for free.
Look at the descriptions
https://ubuntu.com/pricing/pro
Ubuntu Pro:
Expanded Security Maintenance for Ubuntu’s Main repository for an additional 5 years beyond Ubuntu LTS end of standard support (infra-only)
Coverage levels Infra-only coverage Encompasses over 4,700 open source deb packages in Ubuntu’s Main repository for an additional 5 years [...]
Full-stack coverage Provides security maintenance for over 36,000 open source deb packages in the Ubuntu Universe repository for up to 10 years, including [...]
TLDR: They withhold Ubuntu patches in the Universe repo without Ubuntu Pro.
---
If Canonical creates a security patch for a universe package, that patch is gated behind Ubuntu Pro. Standard systems will display notification prompts that security updates are available via Ubuntu Pro, but running sudo apt upgrade without Pro enabled will skip them.
> Free, personal subscription for 5 machines for you or any business you own, or 50 machines for active Ubuntu Community members.
Absolutely. Injecting ads into the desktop and cli, having a package manager that runs as a root service, their decades of poor upgrade testing, etc.
I have never found them to be trustworthy when other, better options exist.