After about a month with no security updates on any ubuntu machines (during which time I know there were security alerts in Debian for packages I use), I finally tracked down the answer.
It turns out that if you use synaptic, click on "Mark All Upgrades", then click on Apply, synaptic will pull in security updates. However, if you use the "Ubuntu Upgrade Manager" in the System->Administration menu, or if you use commands like apt-get -f dist-upgrade or aptitude -f dist-upgrade, then the sources which synaptic wrote into sources.list are not sufficient to get the security updates. (Where synaptic keeps its extra sources, I still don't know.)
When I asked about this on #ubuntu, I was pointed to a page on the Ubuntu wiki which walks you through selecting sources in synaptic. Unfortunately, the screenshots on the wiki show lots of sources that none of my Ubuntu machines show, and the wiki doesn't give you the sources.list lines or tell you what to do if synaptic doesn't automagically show the security sources.
The solution: to edit /etc/apt/sources.list and make sure the following lines are there (which some of the people on the IRC channel were kind enough to paste for me):
## All officially supported packages, including security- and other updates deb http://archive.ubuntu.com/ubuntu hoary main restricted deb http://security.ubuntu.com/ubuntu hoary-security main restricted deb http://archive.ubuntu.com/ubuntu hoary-updates main restrictedIn addition, if you use "universe" and "multiverse", you probably also want these lines:
deb http://archive.ubuntu.com/ubuntu hoary universe multiverse deb http://security.ubuntu.com/ubuntu hoary-security universe multiverse deb http://archive.ubuntu.com/ubuntu hoary-updates universe multiverse
[ 22:49 Aug 14, 2005 More linux | permalink to this entry | ]