Comment 4 for bug 1370416

Thanks for your concern; this is standard and expected behaviour. The security.ubuntu.com server farm is fairly small and on limited bandwidth compared to the wider Ubuntu mirror network so our security updates are periodically copied into the -updates pocket for wider distribution and mirroring.

This allows the majority of people with daily checks to mostly get their updates from the mirror network, saving bandwidth for security.ubuntu.com and providing them with faster downloads but still allows for people to get security updates as quickly as we publish them, if desired.

Depending upon when your machines request package list updates from the mirror network, and which mirrors you contact, and where in that individual mirror's copies you land, you may get a security update via the -updates pocket or the -security pocket.

Some additional background on this can be found at https://wiki.ubuntu.com/SecurityTeam/FAQ#Repositories

Good paranoia, but this part is acting as normal. :)

Thanks