Yes, but with the exception of sshd (which you get asked about during install), none of these things (NONE!!!) is enabled by default.

I am probably misremembering, but the OpenBSD documentation used to even explain how to disable inetd if you were too paranoid to use that. It is now disabled by default, and--I just checked one of my running systems--my machine does not even have an /etc/inetd.conf file. Most of the things running on a default install are init, cron, slaacd, a handful of gettys, ntpd, syslogd, and sndoid. Arguably sndiod is the only thing you could really remove from that list.

But if you look at the security track record of opensmtpd, you'll quickly see that "Only two remote holes in the default install, in a heck of a long time!" Does not relate to the base system, but to the "default install" - that is; only sshd listening (and possibly pf).

IMNHO more interesting than bickering over the "secure" label, is all the work openbsd has done and is doing to develop stuff like pledge.

You're forgetting their SMTP server had a remote root RCE a few years ago, their IPSec server an authentication bypass, etc.

Both of these were logic bugs and not "insecure C code".

It doesn't matter as they are not enabled by default.

So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.

You could as well just not enable network by default. Which makes Windows 95 safer than OpenBSD.

You're not being intellectually honest. Most of those things are disabled by default, so if the httpd had a remote hole, but was disabled by default, then that's not "pArT oF tHe DeFaUlT iNsTaLl" and thus not technically covered by their vaunted claims, and you know it.