Performance common wisdom: "OpenBSD is slow" "exploit mitigation techniques cost a lot of performance" that assertion is false we carefully evaluate performance impact some come with minor cost, not relevant high cost? either not enabled by default or idea dropped