> I almost totally agree. If it wasn't for security fixes, there would be no value in updating almost any software. Software developers know this, which is why

> I almost totally agree. If it wasn't for security fixes, there would be no value in updating almost any software. Software developers know this, which is why they maximize the scariness of all security fixes, and minimize your ability to separate security fixes from all other software changes. How much churn did you have to swallow to fix "algorithmic complexity attacks" you never saw, which would at worst result in a DoS? Did anyone actually attack your hash tables?