I'm curious what software they're counting as "Debian." Are they counting the way OpenBSD reckons--"Only two remote holes in the default install, in a heck of a

I'm curious what software they're counting as "Debian." Are they counting the way OpenBSD reckons--"Only two remote holes in the default install, in a heck of a long time!"--key word being "default install." Or are they counting the combined vulnerabilities in Debian's 59,000+ packages? Debian is a lot more than an OS, it is a project to vet and distribute a helluva lot of free software.