Maybe a broad question, but I would like to know if is there any difference between those distros regarding security and privacy.
For instance, I was not able to find an official privacy policy for linux mint and I read ubuntu shares dash typed info with third-parties if not opt-out.
Thanks in advance.
Mint uses Ubuntu repositories. Depending on what you install they're pretty much the same.
But moreover, you cannot expect that the developers of a distro as big as Mint/Ubuntu are aware of the privacy concerns of every package. OK, that is pretty subjective so I'll add an example:
Some people consider Firefox's (and Chromium's) OSCP certificate verification to be an invasion of privacy. That is because you never asked Firefox to check the certificate against the OSCP database, and that database gets to know your browsing habits.
Still Firefox is in the official repositories of pretty much every Linux distro and with OSCP enabled. Hell, it comes by default with most of them.
There are also the APP repositories, which can carter any software. The APP repositories are policed to some extent, just like, for example, Arch's AUR, but there may be a considerable amount of time until a problematic piece of software is removed.
Several pieces of firmware (notably drivers) are closed source.
Flash player, Skype, are other examples of software that is closed source and that can be installed.
Again, it depends whether you actually use these things.
caveat emptor
The moral of the story above is that privacy is not something that is maintained by a distro, but depends on what software you run. And, to be on a decent level of privacy (but without going paranoid) you need to be somewhat aware of the software you run.
Of course, pretty much any Linux/*BSD distro is never as bad as the privacy tragedies sold by Microsoft or Banana Corp (cannot say the name explicitly, I'm afraid of performing a trademark infringement :) ).
These are really separate questions. Privacy is a holistic concern that touches much more than the core security of the operating system. The security of a general-purpose operating system should be mostly unobtrustive whereas privacy very quickly involves compromises between privacy and usability.
Which respects user privacy more?
Ubuntu's default interface (with Unity) makes online searches, which is obviously not good for privacy. However you don't have to use the default interface (and I don't recommend it anyway, because it isn't very usable and it isn't very stable).
If privacy is an important goal, you may want to use Tails instead of a general-purpose distribution. Tails insists on privacy by default, which comes with its share of lack of comfort when using. If you want to save data from one session to the next, you need to activate this explicitly — forget this and you'll lose all your work when you shut down the computer. All Internet traffic goes via Tor which has a significant cost in latency and bandwidth.
Are both source codes fully and publicly available for scrutiny?
Most distributions use mostly open source code but include some closed-source software and closed-source firmware (firmware is software that runs on a processor other than the main processor, e.g. the graphics card).
Debian, Ubuntu and Mint all track non-free software separately: in Debian it's in the non-free repository, in Ubuntu it's in the restricted and multiverse repositories. You can choose not to install any non-free software.
Avoiding non-free firmware is unfortunately difficult. You have to shop for hardware very carefully.
The availability of source code is not a guarantee of additional security anyway. Having source code makes it easier to discover security flaws, but that only matters if someone is looking. Having open source code also helps to some extent with potential backdoors but you still need to trust some of the system.
Are rolling release distros safer?
This one actually has a fairly clear, unlike the previous two… No, rather the opposite. A rolling release means that you get all the latest bugs. Sure, you get all the latest bug fixes as well, but so does a release-based distribution. Release-based distributions apply security patches to the existing versions of their packages. So a release-based distribution gets as many security fixes as a rolling release distribution, and has fewer unknown bugs. Rolling releases are for people who like living dangerously.
