

Two extremes here. Debian is slow to update while arch is bleeding edge.
I avoid containerized desktop apps (snap, flatpak) so I couldn’t run Debian as a daily driver. You’d want to use the latest FireFox and their repo’s release is old. You you can get it from flatpak, but I don’t want to do that. Running on recent (<1y) hardware will also be problematic. I guess you could keep on adding 3rd party repos to your install, though some post from debian forums always stuck with me: “Debian is only what is released + whats in the official repo. Install anything else and you’re not running debian anymore.”. Its a whacky OS and I love it, but daily drive it only on my server.
Arch puts everything on their repo straight away. And if its not there, you’re downloading code from AUR and building it yourself. I actually appreciate this since it complies with the philosophy that you can’t really trust your applications unless you read the source and build it yourself. Awesome, but the general public shouldn’t be doing this… I don’t mind applications being distributed in binary form. I am able to trust linux community maintained repositories. Arch is for the geeks imo.
I found Fedora to be a good middle ground, since it gets package updates straight away while still maintaining fixed OS releases. No need for snap or flatpaks since their repo has everything and is updated. Its also widely supported by software vendors (just like debian). Id go with it as a recommendation, but still note that its philosophy is free software only and this can potentially mean tinkering with additional stuff from RPM fusion, especially if you dance with nvidia and watch videos encoded with non free codecs.
It takes a bit of time to find the right distro and that is the biggest obstacle to linux imo.



My use cases are:
For home networked devices, I don’t care about security that much. I try to lock it down on the router level and by using VLANs for less secure devices. I connect via IP directly (or .local domain).
Jellyfin runs under its own user with read access to a media library.
For devices on the internet, I have jellyfin exposed on a specific url path of my domain - through a reverse proxy all through 443. A bit of security through obscurity here. I’m proxied through cloudflare on the DNS side with very restrictive IP rules.
I think this is enough for the security flaws jellyfin does have. I’d sleep better at night if it had client certificate support, but Its not a big deal imo. If security flaws allowing remote code execution are found, I’ll shut it down and allow access through wireguard only and lose access from some devices on the internet where I cant use VPNs. Not a bit deal either.