Just to make sure that I did not forget anything:

$get_recent_sources (stable).

cd /usr/src
find . -type l -name obj |xargs rm
make cleandir
rm -rf /usr/obj/*
make obj
cd /usr/src/etc && make DESTDIR=/ distrib-dirs
cd /usr/src/sys/arch/i386/conf
config GENERIC
cd ../compile/GENERIC
make clean && make depend && make
cp /bsd /bsd.old
cp bsd /bsd

reboot

cd /usr/src
make build

reboot

Is this enough? After that kernel and apps (postfix, httpd, ...) are
recent, no more (known) security holes? (Yes, I *can* read the FAQ, but
did I understand it?)

Thanks, Helmut