Petru
OpenACS could easily be included in the Mandrake distro. In fact they asked me for it, I just didn't have enough experience with Postgres to get it included and was working on the Oracle version mostly. If someone wants to get the entire package together for Mandrake, I will get it included in the next release.
ACS classic will never be included because it depends on Oracle.
Zope was such a problem Mandrake stopped distributing it because every other week there was another "hot fix".
I know the history of ACS and its security (as well as your role in some of it). I would say that the one major change (thanks in no small part to you) closed up the holes. Do others exist? Maybe, but a lot of people have looked at this code outside AD now and the last security scare (javascript) really only applied to the pre-security fixed releases.
