On my client(s) website, I turned the update module on. From time to time, they receive an error message on every page about a security update. They complain about this message, and they don't want to see it, so I turn the module off. I still want to keep up-to-date with all the security upgrades. How do I make sure I receive security updates? Is there a feed, an email list?
I personnally prefer to let update status on and register my email in
admin/reports/updates/settings. Being subscribed to the Drupal security list is a must do, but you will receive security updates for every module on drupal.org and after a while you may don't remember which module you have installed on you client website and miss one update or have to go to his website to find out.
So, activate update status, install Disable Messages to hide the status update warning, and put your email to receive updates only for theses modules. Also in some email provider you can receive email with the plus (+) sign in the form of firstname.lastname@example.org then when you monitor various client website, you can filter the update regarding the "+".