so you install Oracle on a Debian installation, it's Debian's job to ensure Oracle is secure? I'm not talking applications provided by the distribution, those

so you install Oracle on a Debian installation, it's Debian's job to ensure Oracle is secure? I'm not talking applications provided by the distribution, those aren't "applications" (i.e. in my usage, something installed onto an existent operating system), but part of the provided operating system itself, and yes, I'd agree it's their job to keep their provided operating system secure. It's not their job to keep external apps secure (but to provide the means for whoever is maintaining those apps to keep them secure).