Project Results

Often ahead of the bug curve
"Fixed six months ago" not uncommon

Found 1000's of bugs
often found elsewhere

New classes of bugs

Not always perfect
select() vulnerability (2002)
not all code has been checked (yp subsystem, libz)