After installing Debian 9.1, the sources.list entry for security updates used this URL:


According to SourcesList and Security Information, the URL is:


Are these URLs equivalent for the purpose of getting security updates? Any difference? Why does the installer add the debian-security path?


Both URLs work. The server serves the same content at http://security.debian.org/PATH and http://security.debian.org/debian-security/PATH.

The URL with /debian-security has to exist because it's the only one that works with mirrors¹. /debian-security is also required if you use FTP, or if you run a release that's no longer maintained and download from archive.debian.org.

I don't know why the shortcut without /debian-security was created, but it's been mentioned in so many documents that you can count on it not to go away.

¹ Public mirrors are discouraged for debian-security, because security updates should be distributed as fast as possible. But private mirrors are useful for an organization that has many Debian machines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.