I don't disagree. SSH was already 25 years ago a mature code base with (more importantly) a limited scope and unchanging core requirements. I think its long li

I don't disagree. SSH was already 25 years ago a mature code base with (more importantly) a limited scope and unchanging core requirements. I think its long life and limited scope is more of a factor to its security success than how good the coders were. Once you get out of the simple case of "RCE on pre-auth sshd" OpenSSH is no longer looking as good. E.g. CVE-2019-611 is way underhyped, and the fact that it was only discovered in 2019 doesn't speak well for OpenSSH's audit process. But for "is it safe to open OpenSSH to the world" I'd say "that's safer than anything else, sure". But that's a very narrow (though important) attack vector.