&gt; This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys.<p>Please don&#x27;t spread FUD.<p>Debian does a great job of creating and maintaining a stable, secure, and coherent operating system.<p>They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in &#x2F;etc, data in &#x2F;var&#x2F;lib, etc). IMO, they do a better job than any other Linux distro.<p>Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package.<p>Finally, Debian aims to be stable, which means they&#x27;ll keep an eye out for vulnerabilities and backport fixes. This is done <i>instead</i> of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config).<p>The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian&#x27;s security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical&#x2F;Ubuntu).