Has there been any discussion to do something like FreeBSD, i.e.
make every release (1.5, 1.5.1. 1.5.2, 1.6, ...) a branch to allow
people to track only security fixes.

I'd like to be able to update my 1.5.1 hosts to include the patch
against the telnetd vulnerability (or any future vulnerabilities)
but without introducing any "untested" code found in 1.5.2_ALPHA.
So something like this until 1.5.2 is released:

    # cd /usr/src
    # cvs -q update -r netbsd-1-5-1 -dP
    U src/libexec/telnetd/telnetd.c

Then when 1.5.2 is out I'd perform this and again follow 1.5.2
until 1.5.3 (or 1.6.x) is ready:

    # cd /usr/src
    # cvs -q update -r netbsd-1-5-2 -dP
    [ Security fixes for 1.5.2 ]

Martti

---
Martti Kuparinen <martti.kuparinen@iki.fi>
http://www.iki.fi/~kuparine/