I apologize for
this edit which you ended up reverting, @Gilles. I thought for sure it was a typo on your part that inverted the meaning. I still don't understand though, actually. You'd list
security.debian.org
if you
don't want security updates and omit it if you
do?