Philosophy of default "pkg_add -r" PACKAGESITE?

[Kris Kennaway]

Gueven Bay wrote:
>>> I'm curious, why does "pkg_add -r" point to the "release" snapshot of
>>> ports by default?  Is the idea that a "release" is well-tested and that
>>> any deviation from that (even security or bug-fix changes) is an unknown
>>> that new users need to be shielded against when grabbing packages with
>>> "pkg_add -r"?  Seems to me it would be better to have "pkg_add -r" point
>>> to stable (which, if I understand things correctly, does get updated
>>> packages).
>> -release packages have gone through an extensive period of testing with
>> that release, so you have more confidence they will work.  The
>> up-to-date packages may not work, may not even be present on the FTP
>> site, and in general are not suitable for users who just want a working
>> system without having to fiddle with it.
>>
>> i.e. defaulting to the packages that came with the release is a
>> conservative step that is appropriate for users who just want packages
>> that work, and don't care about always having the latest versions.  For
>> the rest of you, you're going to be doing a lot more hands on admin
>> anyway, so setting one env variable is not a heavy burden.
> 
> Do the -release packages get updates for security (and only for
> security) reasons?
> I ask because I don't find any information about this on the FBSD webpages.

No, we don't have the resources.

Kris