Might also be worth noting that Debian's disregard of the upstream (compared to say Fedora, which makes an effort to get patches into the upstream before using

Might also be worth noting that Debian's disregard of the upstream (compared to say Fedora, which makes an effort to get patches into the upstream before using them), has gotten them into trouble on a few occasions. The most prominent in recent time being their absolutely braindead patching of OpenSSL which dramatically reduced the entropy in key generation, which would have never made it through the peer review process of the upstream... Debian likes to think that they are the upstream of the projects they use, but unlike the BSDs they really are not.