But it also provides bugs, as demonstrated. (As another anecdote, at least as of many years ago, grsec + OpenAFS led to frequent deadlocks that never happened with a stock kernel.) Now of course Linux has tons of bugs too as does every nontrivial patchset being merged into Linux. But grsec has a preference for risking bugs that compromise functionality &#x2F; uptime but not integrity. Linux upstream has exactly the opposite preference.<p>On a desktop machine, a slightly increased risk to system availability is totally okay. On a server machine, it&#x27;s a harder call, especially if the security benefit is only a defense-in-depth measure. For most servers out there, if they&#x27;re running arbitrary code as an unprivileged user, something has <i>already</i> gone horribly wrong.