> Only two remote holes in the default install, in a heck of a long time!
> сказочка так и будет висеть на главной?

Почему сказочка? Просто у них немного "альтернативно" трактовали/трактуют значение слова уязвимость:

https://pwnies.com/archive/2007/nominations/
> OpenBSD IPv6 mbuf kernel buffer overflow (CVE-2007-1365)
> The OpenBSD team refused to acknowledge the bug as a security vulnerability and issued a "reliability fix" for it. A week later Core Security had developed proof of concept code that demonstrated remote code execution.

https://web.archive.org/web/20070317193433/http://www.corese...
> > 2007-02-20: First notification sent by Core.
> 2007-02-20: Acknowledgement of first notification received from the OpenBSD team.
> [...]
> 2007-02-26: OpenBSD team communicates that the issue is specific to OpenBSD. OpenBSD no longer uses the term "vulnerability" when referring to bugs that lead to a remote denial of service attack, as opposed to bugs that lead to remote control of vulnerable systems to avoid oversimplifying ("pablumfication") the use of the term.