That means no Internet-facing service has ever had a bug of the sort that often becomes code-injection. Or they didn&#x27;t test for exploitability in the case of mitigations being bypassed. Neither one makes the claim stand up as it has hidden implication of &quot;only two remote holes for amateurs and people ignoring mitigations.&quot;<p>&quot;What really annoys me with OpenBSD is that users are expected to download the CVS source and compile it to fix problems rather than upgrade to a dot-release.&quot;<p>Yeah, that sounds like it could be annoying. They should have both options available given they already have to trust OpenBSD team to not backdoor their stuff.