> This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and

> This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys. Please don't spread FUD. Debian does a great job of creating and maintaining a stable, secure, and coherent operating system. They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in /etc, data in /var/lib, etc). IMO, they do a better job than any other Linux distro. Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package. Finally, Debian aims to be stable, which means they'll keep an eye out for vulnerabilities and backport fixes. This is done instead of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config). The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian's security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical/Ubuntu).