David Freeman <david_freeman@rocketmail.com> writes:

...

That's all well and good, but what do you do when the vendor's updates break core functionality required by your users? One thing Debian [...] So true. I have a simple technique. MASSIVE firewall and a discontinuous network connection. simple it works.

I can't get local admins to agree to that, as it involves doing it at the network rack because the machines need to talk 100Mbps to each other. Sad, but true. Maybe after the next hack... -- MJR