But something like Springdale, given resources, might be able to provide. They're still tracking RHEL 7, though.

Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software.

Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited.

OpenSUSE Leap versions seem to get three years, which really isn't enough software that needs to just work for a long while.

Here's the full ISO for 8.1: http://puias.princeton.edu/data/puias/8.1/x86_64/iso/

And then you can add the repos to update to 8.3: http://puias.princeton.edu/data/puias/8.3/

Or you can take the small ("boot") ISO and install 8.3 directy: http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/

In fact, they are even building Springdale Linux 8 for i386, which RHEL and CentOS never did.

If you need more than three years on openSUSE Leap, then you need to upgrade to SUSE Linux Enterprise Server.

Remember that, in Ubuntu, the majority of packages are actually ONLY supported for nine (9) months -- not the full 5 years!

I claim no deep expertise on this, but for a distribution of 56k packages, this looks quite good https://security-tracker.debian.org/tracker/status/release/s...

To anyone here who's worked secops and has to track these things, I'm really interested to hear opinions about how well Debian follows up on this

I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel?

This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.