I would like to see format guard, stack guard, race guard and subdomain from http://www.immunix.org. Thre are free opensrc. modules....we build our public dmz linux servers with the above and use similar approaches with our openbsd servers. If exploitable code is present on astaro, The above would ellimate or reduce damage...giving the admin time to be notified that a patch exist.