On Fri, Nov 02, 2018 at 08:01:59PM -0700, David Christensen wrote:
My intent was to install just what was on the CD onto a machine in my LAN. I was unaware that d-i connected to the Internet when I told it not to use a mirror. As security.debian.org is not a mirror in the usual sense, perhaps this kinda sorta makes sense to the Debian developers. For me, it violates KISS and the Principle of Least Surprise. I think the d-i needs to be more clear about if/ when it intends to connect to the Internet, and obtain explicit user approval.
Did you run an expert install? I believe that's one of the questions.