"Actually, the only distribution of Linux I've ever used that passed the rootshell test out of the box (hit rootshell at the time the dist is released and see if you can break the OS with scripts from there) is Debian." -- seen on the Linux security-audit mailing list