This certainly used to be the case. There appears to be an actual channel now, though: http://security.debian.org/debian-security/dists/testing-security/ http:

This certainly used to be the case. There appears to be an actual channel now, though: http://security.debian.org/debian-security/dists/testing-security/ http://security.debian.org/debian-security/dists/testing-sec... I don't know if anything actually shows up here, but you no longer get the error for security.debian.org when you try to upgrade via s/stable/testing/ in sources.list.