I’ve been wanting to post almost this identical question. I’ve been on Ubuntu lts for a few years, and Fedora before that. I’m constantly back and forth in my head on running more up to date -> less known CVEs, or older, more tested code that has less chance of a malicious commit slipping slipping through.

Tools wise, I keep a very minimal desktop and virtualize anything I need. Or, occasionally I’ll use an old desktop/laptop to host something if I need bare metal.

Yes. I keep two package.json files for my Node.js application. One has all the trillions of dev dependencies and the default one has almost no dependencies. This way my application does not trip any dependency security alarms.

[flagged]