Question
How frequently does the Ubuntu Gnome ISO get updated to include the latest available security patches and other bug fixes? And how can I find out that the ISO has been updated? Or does it remain the same for its lifetime (that would be 9 months I guess) with all updates being provided OTA (over the air) only?
Release images are static and aren't re-released unless there's a serious bug on the installer. This is reflected in the dates of the images, as seen on the Releases site. There will probably not be a fresher ISO for 17.04.
LTS versions usually get point releases (eg 16.04.1, 16.04.2 ..). Sometimes these will just be updated versions of their predecessors but they often also include newer kernels. There's no hard rule on this so check release notes.
Versions in development will have "nightly" or "daily" images available, although these are really not suitable for day-to-day use. Don't assume that everything is latest and most secure, that's often not the case.
The graphical installers usually have a "download updates" option which downloads newer versions for installation. You're still booting into an older version to do the install though.
And 16.10 isn't a great candidate for staying on something until you find another Ubuntu release because it leaves support this July. I'd suggest the 16.04 base release (not the 16.04.2 point release which probably has an updated kernel in it). Doesn't fix your ISO security paranoia that might be driving this question, but if you can update from installer in a non-hostile network, I don't think there's a problem.
The released ISOs are never updated. LTS versions get new point-release ISOs, but non-LTS releases like 17.04 will always have the same ISO they were released with. This is similar to how the release pocket of the repository (
trusty
, as opposed totrusty-updates
,trusty-proposed
, etc.) is frozen and does not receive any updates (see Security Team's FAQ).You can probably use the daily ISOs, which will get slowly updated to the next version (and, of course, have all the associated instabilities of a development version).