Well, OpenBSD's 5 year record ( "Five years without a remote hole in the default install!" ) is no more, it was broken with the openssh vulnerability....

OpenBSD's website now reads: "One remote hole in the default install, in nearly 6 years!"
which is still pretty damn good imho...

Ammo