This. I agree with this. Freezing the work does not work particularly with certain packages. For example, I still see lots of usage of old versions of openssl

This. I agree with this. Freezing the work does not work particularly with certain packages. For example, I still see lots of usage of old versions of openssl (0.9.8) and openssh. If we even just make sure to cover these two packages and the related dependencies/affected applications alone, that would go a long way in covering attack vectors (obviously not comprehensive)