I&#x27;m glad you&#x27;re saying it, too, as I get tired of this myth. I wrote a scheme on Schneier&#x27;s blog for disproving it a while back. Basically, you counter the mitigations which look awfully similar to the one&#x27;s that got countered in Linux and Windows. Once you have that, wait until a bug is mentioned on mailing list that can lead to memory attack. Weaponize it. Profit.<p>Leads me to what I claim is dirty secret behind &quot;only 2 holes in...&quot; claim they have: OpenBSD just fixes bugs they find without serious attempts to determine if they&#x27;d be exploitable vulnerabilities. They just do accounting differently than the rest. So, by their numbers, they only had 2 vulnerabilities because they didn&#x27;t assess whether other bugs were vulnerabilities in the first place.<p>They have good code quality but they&#x27;re full of shit about how vulnerable it is or isn&#x27;t.