PITA With normal install you can just configure unattended-upgrades (on Debian at least) and mostly forget about security updates, they will just happen (can e

PITA With normal install you can just configure unattended-upgrades (on Debian at least) and mostly forget about security updates, they will just happen (can even set a schedule for reboots for kernel updates IIRC). But IIRC boot on card + root FS on SATA or USB-SATA works just fine and you only get some writes off occasional kernel update