I am far from a blackhat/malware expert, but I've used enough ASLR exploits with ROP toys to win a few CTF's. I'm way too old to have any allegiance to BSD vs L

I am far from a blackhat/malware expert, but I've used enough ASLR exploits with ROP toys to win a few CTF's. I'm way too old to have any allegiance to BSD vs Linux vs POSIX{foo}. I say this to clarify my point - in the 90s I was a teenage-FreeBSD bigot; now, I don't give a hoot. To successfully manipulate the lack of memory address randomization (i.e., attack via ASLR), one either either has a target running BIND circa 1999 that will let you smash the stack and 'sploit da EIP remotely, or the malicious attacker has a local, non-jailed shell. At which point you have far more to worry about than ASLR. DEP and ASLR are effective (especially with doing interesting things more advanced than just swapping on a ROP gadget - JIT stream exploits are _very clever_) but I'd take the out-of-the-box FreeBSD over any distro of Linux out-of-the-box for security.