I hava a personal homepage. I am not host it my self but I pay for the hosting services. The server that I host my homepage runs Redhat 9 os. Next month Redhat 9 will be "death". I asked the administrator there that what he will do?

Upgrading to RHES?
Change the os? Maybe to Slackware, Mandrake, Debian, FreeBSD, ..... ( and the list goes on )
Stuck with RH9?

The answer is he will stuck with RH9 because there is no plan for upgrading. If he change the os of the server, the server will be down for about one day. Again, he told me to not worry about it because although Redhat company will not support security updates for RH9 anymore, he will get support from community.

Until this day, I have not reply his email. My homepage is not important. If my homepage get hacked, I would not give a damn care. But I am not happy with his decision. Because this is my policy for security in Linux:

Always update, update, update, update the security from the official ones. Never use the outdated security product.

It means if you decide to run Redhat os, then you have to update it from Redhat official server not from community. If you don't want it that way, the run another distro like Slackware and Debian.

I never trust third party option for security updates. I always trust the official ones.

Please give me your opinion!!!!! Is my policy wrong?

Any given piece of software eventually will stop being supported. In the case of Redhat, although the v9 release will hit its EOL in April, that doesn't mean that any machines running it will simply stop functioning. Instead, it means that the admins of those machines will need to spend a lot more time manually monitoring security bulletins, applying upgrades, etc, because Redhat will not be doing it for them automatically. Long term, if you are running RH9, Yes, you may want to look into making a change. Short term, I wouldn't panic.

You are smart for asking your hosting company these questions, and if they act like it's no big deal, you would be wise to switch hosts. In other words, if your host's actions reflect that he doesn't really care about security issues, it's time to look elsewhere. -- J.W.