Philosophy of default "pkg_add -r" PACKAGESITE?

[Gueven Bay]

> > I'm curious, why does "pkg_add -r" point to the "release" snapshot of
> > ports by default?  Is the idea that a "release" is well-tested and that
> > any deviation from that (even security or bug-fix changes) is an unknown
> > that new users need to be shielded against when grabbing packages with
> > "pkg_add -r"?  Seems to me it would be better to have "pkg_add -r" point
> > to stable (which, if I understand things correctly, does get updated
> > packages).
>
> -release packages have gone through an extensive period of testing with
> that release, so you have more confidence they will work.  The
> up-to-date packages may not work, may not even be present on the FTP
> site, and in general are not suitable for users who just want a working
> system without having to fiddle with it.
>
> i.e. defaulting to the packages that came with the release is a
> conservative step that is appropriate for users who just want packages
> that work, and don't care about always having the latest versions.  For
> the rest of you, you're going to be doing a lot more hands on admin
> anyway, so setting one env variable is not a heavy burden.

Do the -release packages get updates for security (and only for
security) reasons?
I ask because I don't find any information about this on the FBSD webpages.

Thanks.