Why don't they upload packages to the normal package repository? Is this a general convention (IE, do other distros separate the repositories also)?
Why is there a separate package repository for Debian security updates?
debian;repository
Debian has a distribution channel that provides security updates only so that administrators can choose to run a stable system with only the absolute minimum of changes. Additionally, this distribution channel is kept somewhat separate from the normal channel: all security updates are fed directly from security.debian.org, whereas it is recommended to use mirrors for everything else. This has a number of advantages. (I don't remember which of these are official motivations I read on Debian mailing lists and which are my own mini-analysis. Some of these are touched on in the Debian security FAQ.)Security updates are spread immediately, without the delay incurred by mirror updates (which can add about 1 day of propagation time).Mirrors can go stale. Direct distribution avoids that problem.There is less infrastructure to maintain as a critical service. Even if most of Debian's servers are unavailable and people can't install new packages, as long as security.debian.org points to a working server, security updates can be distributed.Mirrors can be compromised (this has happened in the past). It's easier to watch a single distribution point. If an attacker managed to upload a malicious package somewhere, security.debian.org could push a package with a more recent version number. Depending on the nature of the exploit and the timeliness of the response, this could be enough to keep some machines uninfected or at least warn administrators.Fewer people have upload rights on security.debian.org. This limits the possibilities for an attacker trying to subvert an account or machine in order to inject a malicious package.Servers that don't need ordinary web access can be kept behind a firewall that only allows security.debian.org through.