> OpenBSD has shown that small organizations can audit and maintain code with a focus on security and correctness, why hasn't the FSF, with its greater level of

> OpenBSD has shown that small organizations can audit and maintain code with a focus on security and correctness, why hasn't the FSF, with its greater level of resources, managed to do the same? It's simply a matter of different goals. The OpenBSD project has security as a primary goal. They often throw out features, flexibility or portability on the grounds of preserving security. GNU instead prioritizes those features, flexibility and portability, occasionally losing out on security. Security is hard and involves a lot of sacrifice with little evidence of success aside from "oh look, we haven't had any vulnerabilities for a while".