But you said that "bad security is worse than no security". So better no GNU Mach than an insecure one, right?
A system works just fine without a random translator, it does not work at all without an secure, or insecure kernel. A random translator is _not_ a crucial part of an system, a kernel is. Really, I don't think we delete packages just because we have bugs. We have *lots* of bugs, and it's inappopriate to remove packages as if we were a production system. Delete what exactly? We were talking about _adding_ a package.

