> Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches en

> Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches enabled by default is quite another. That's exactly my point. That's why I find it so annoying that these articles say the wrong thing. > Neither grsecurity nor OpenBSD "invented" PaX/W^X. They were using pre-existing hardware features designed precisely for this type of capability, The first version of PaX predate the page table no-execute bit in x86 hardware, and I believe (eventually) W^X didn't require it either. So no it was not a matter of merely starting to use existing hardware capability. That's why it even was an invention in the first place. Everything got vastly easier once the page-level execute bit was launched in hardware. At the time, when OpenBSD was asked "why aren't you looking at what PaX did?", and they answered that "we don't care what others in the industry are doing". Which is a strange way to think you can create the best security. So Linux patches: 2000. OpenBSD: 2003. Windows: 2004. (not saying OpenBSD didn't do it better, because they don't care about binary compatability, making it easier) If OpenBSD had "invented" it, then how could microsoft possibly have launched it only one year later? Again, I do credit OpenBSD for being the first OS to do these things by default on an OS. But that is, as you said, is "quite another [thing]" from inventing it.