Among the reasons I like OpenBSD is that it tries (hard) to be "secure by default", meaning, that the initial install has had "only 2 remote holes in the defaul

Among the reasons I like OpenBSD is that it tries (hard) to be "secure by default", meaning, that the initial install has had "only 2 remote holes in the default install" since about 1996. Then as I make changes from that default I can consider the implications of each one. And I appreciate the low likelihood of privilege escalation (I keep seeing those bugs come up for the linux kernel, not for OpenBSD), and pledge/unveil limiting what apps can do to what they normally should do, so that damage by compromised apps can be greatly limited to a given user account or less. And yes, the clarity of documentation (like the excellent FAQs) and predictability of the system. So basically, I read news all the time about this or that exploit, and I am not in the vulnerable group. But I do think that it took me more work to get set up the way I want, than when I used Debian more, but that work was very well worth it, and even more so when I include my config customizations to various apps that now work just as I want. One addition to the base system I always make is to change the /etc/profile to set the default umask to 0077 (and other changes for my own convenience etc). I've long wondered why umask 0077 is not the system default. Although after changing it I had to wrap pkg_add in a script ("pa") which sets it back to the original default so that some apps don't get broken during installation for some reason. Also, it seems worthwhile to choose compatible hardware, or some things might not work.