My point here is not to go against the closing, it was a community decision, but to try to better understand since I have the impression to miss something in what I feel to be a possibly basic but nevertheless correct question.
As a non-commercial user,
The OP starts by stating the context of his question, which is good thing.
what distribution should I consider to be reasonably confident that I will get timely security patches?
Granted, this one may sound as a product recommendation, but from the sequel below I'm not sure that the OP really expect an actual name but merely advices on how to choose.
My current strategy is to pick one of most popular distributions and hoping for "enough eyeballs effect" to take place.
Talking about how to choose, the OP present his current criteria so we can provide a feedback whether it makes sense or not.
Are there distributions that have noticeably better track record than others?
Now he asks for objective information sources which can help in this decision. To some people here these track records may be obviously a wrong criterion, but from a marketing point of view it is what is used by some commercial Linux distributions which are fighting against others by producing statistical charts "prooving" how they perform well against the competition (for what matter, yes Oracle Linux I'm looking at you).
At this point, the fact that marketing people are precisely targeting this aspect makes me think that the OP is not the only one to think this way and that it worth a question and an answer.
For example, good distribution would have most fixes available as updates within hours, while bad one would make applying critical patches unnecessarily hard (and no way to make them automatic).
Still seeking for objective criterion, the OP does not limit itself to the time needed for the patch being available, but also for the complexity caused by the the patch application (which is a right mindset, some distributions for instance providing only a source code patch requiring compilation, or bundle the security update with new features which could require configuration changes to get it running).
I suppose I must misinterpret something here, since I just see someone asking for advices, and not opinion, in a question generally well formulated (puts a general context, shows personal research, suggest objective possible criterion as a example and request for feedback on these).
