OpenSSH: I think that the recent release went very well. Anyone who did not have their head in the sand knew and had an opportunity to close the vulnerability. A few people are complaining that Theo "cried wolf" in not just recommending that the offending feature be disabled. Perhaps they would feel differently if it was a feature that mattered to them (as it matters to the people who use it)? A typically selfish attitude to take.