Would you rather have the kernel filled with false or botched security?