RedHat also does a ton of hardening (ASLR since 2004), and they employ the people that wrote most of the implementations. They've historically been quite good

RedHat also does a ton of hardening (ASLR since 2004), and they employ the people that wrote most of the implementations. They've historically been quite good and fast with security updates, and are one of the vendors that gets the inside track on security embargoes. They're also really slow and stable, which is nice for boring plumbing.