I have a server running FreeBSD 13.1-RELEASE and the experience is kind of mixed. Things from the top of my head in no particular order: - I like the idea of "

I have a server running FreeBSD 13.1-RELEASE and the experience is kind of mixed. Things from the top of my head in no particular order: - I like the idea of "kern_securelevel", but I can only use it on the low setting (1 out of 3) because the machine (VM) is sometimes powered off and its time gets de-synced. The server is running ntpd but on this security level you're not allowed to change time by more than a second. - ntpd doesn't support running with ASLR enabled. Fortunately, you can disable ASLR for a particular process with "proccontrol". - ASLR is not enabled by default. Not that it cannot be defeated but it's a basic security measure, isn't it? - User installed packages put their configuration into "/usr/local/etc/". Or more generally user level stuff goes to "/usr/local". I like that, keeps things more tidy. - Upgrading between major versions requires several reboots. You also have to reinstall / recompile all of your installed packages / ports because ABI can change between versions. - IPv6 didn't work out of the box because the standard DHCP client doesn't support DHCPv6. Getting it to work took me a while but works now with the use of rtsold. - pf is nice. Enabling pflog and then inspecting the logged traffic via standard tools such as tcpdump is handy. - In line with UNIX philosophy, each utility does one thing and one thing only. I find it quite annoying though when dealing with long running services. There doesn't seem to be a standardized way of monitoring once a particular service is started via rc. Some packages use daemontools, some use something else (I forget the name), and some don't do any monitoring at all. Similarly with logging. I very much prefer systemd in this regard. - Jails are cool but annoying sometimes. Jails are created from a particular version of FreeBSD and you have to keep them up to date with "freebsd-update" like a regular host (including the reboot dance). There's a way to share most of the files between jails using mount_nullfs but I haven't tried that. - I miss "journalctl --since=-5hours" every time I ssh into the machine. Not sure how I could do it with just plain log files without parsing their specific format.