Technical reasons to choose FreeBSD over GNU/Linux (2020)

Earlier revision discussion: https://news.ycombinator.com/item?id=22852316

Let me pick and choose a few points since replying to everything will necessitate a similar 40-page post.

  FreeBSD has great engineering and release management practices
  When someone gets an idea and develops something new, it first gets peer technical reviews

The recent WireGuard debacle left a bad taste about this. As it actually turns out, sometimes there is zero technical review for very important patches and a few blessed developers can (and sometimes do) just throw their stuff directly into trunk.

  Unlike on Linux, the ZFS filesystem is a first class citizen on FreeBSD

ZFS has first-class support on Ubuntu and is compiled into the kernel.

  FreeBSD also supports boot environments

Including this one IIRC.

  Jails

Well... linux has containers, and if all you need is isolation there's this: https://news.ycombinator.com/item?id=29976096

systemd is not required (all the heavy lifting is done by the kernel using the same features employed by containers), but it's available almost everywhere and makes this easy.

  security

I actually think it's worse in this regard because of the link above. Most services on my machines are heavily locked down and isolated from each other since systemd makes this very easy (add a few key-value pairs to an .ini file and it's done). On FreeBSD the developer must add capsicum support (which is not easy to say the least), or you have to setup jails for each and every application manually.

  Capsicum

Excluding the usual boring stuff like seccomp-bpf, we now also have this: https://lwn.net/Articles/859908

It's pretty much unveil for Linux. I think it kind of flew under the radar.

I don't believe there's anything like capcisum, though.

  DTrace

https://www.brendangregg.com/dtrace.html#Linux

There's also real DTrace on Oracle Linux if you're ready to sell your soul:

https://docs.oracle.com/en/operating-systems/oracle-linux/dt...

  bhyve

Not sure if this counts as a particular advantage.

  Firewall

I find nftables to be pretty enjoyable to work with. It has a similar syntax, removes duplication of rules (supporting both ipv4 and ipv6 at the same time), etc. I actually removed firewalld from many RHEL servers and went with nft directly.

  Security Event Auditing

Uhm… so like auditd?

Haven't tried Mono, Node, or anything NoSQL, but Java, Ruby, and Postgres all run pretty well. It is runtime-compatibile with Linux executables and you can even install a linux distro in a jail

https://forums.freebsd.org/threads/setting-up-a-debian-linux...

As a long time Linux and BSD user I agree with you. You still have to enable basic things that are not turned on by default - i.e. stack protection. A lot of this is enabled by default on OpenBSD.

https://vez.mrsk.me/freebsd-defaults.html

I really like this article about FreeBSD. One really nice feature that is not cover though is to set the immutable flags on some binaries with the command chflags. It's possible to boot your very secure system into securemode level 1 or higher. In this mode, it's impossible to delete those files.

rm -rf /* has very limited damage. chmod -R 0000 /* won't touch chmod and all kind of ooops become much less destructive.

It's probably not useful in all scenarios, but definitely some systems deserve to never be touch live. Automation, scada, super important core backbone systems.

FreeBSD is the power to serve. It deserves more credits.