I was making a point that per the other poster's methodology for evaluating security by vulnerability count, plan 9 would win, and plan 9 also meets the posts arbitrary definition of 'useful', in that it can run a webserver, database, and other common software.