please add security.ubuntu.com to the ubuntu mirrors

I don't believe this to be correct, as that's really only a temporary mirror for security updates, see https://wiki.ubuntu.com/ArchiveAdministration#Copying_security_uploads_to_updates for more information

It looks like I might have misunderstood the use here, I'm hoping Marc can clarify whether or not this is actually helpful

We should also wait for input from Eduard who maintains the package in Debian as well as being the upstream dev (thanks for your work!). More specifically, what happens if one of the mirrors in the pool is only a partial mirror? Will that possibly lead to problems?

This shouldn't be needed. Not only is the security pocket available on all regular mirrors, but security updates also get copied to the -updates pocket after a few minutes.

The only reason we preconfigure security.ubuntu.com by default is to make sure users get security updates even when their local mirror isn't working properly.

Marc, of course this isn't necessary. Acng isn't necessary. Apt can work just fine downloading each and every *.deb file for every client. Caching is totally optional. Yet, why download the same package again when it is already there locally? To avoid duplicate downloads of the same information is the whole point of acng and caching. And to that end, the proposed change should be made in my opinion.

Status changed to 'Confirmed' because the bug affects multiple users.

I'm a bit confused about this, can anyone clarify?

My interpretation is that mdeslaur is saying that because updates are in the normal ubuntu repositories, and in the sources.list files security.ubuntu.com is listed last, then so long as there is no problem with the archive repo, files will *not* be fetched from the security repo, and thus this change is unneeded.

Is this correct?

The only case I can think of where this will cause more bandwidth is in the retrieval of a second set of package lists (from security.ubuntu.com), and the gap between packages being on security.ubuntu and the local archive mirror.