debian etch sources.list doesn't exist
 

i have just purchased a VPS running debian etch, everything seems to be running fine but there is no sources.list file in etc/apt - is this a problem? should i just create it myself or is there a good reason it's not there?

That should that be /etc/apt

yeah, that's what i meant, but there's definitely no sources.list in there...

How do you install security updates and install new packages?

Yes, you can write one up yourself. Not much needed (the main repository, the security repository and optionally the multimedia one). I'm sure you'll find the links if you google a bit.