From a vulnerability disclosure point of view: FreeBSD doesn't have OVAL data, and invented their own crappy XML format and disclose vulnerabilities via mailin

From a vulnerability disclosure point of view: FreeBSD doesn't have OVAL data, and invented their own crappy XML format and disclose vulnerabilities via mailing lists (without any automateable parseable format, because it's emails). [1] OpenBSD's erratas are maintained as patch files that people would have to merge in themselves. Literally [2] So yeah, I'd argue to use Arch over BSD anytime. They patch vulnerabilities upstream first, don't diverge in their packages from upstream when it comes to backports, and patch critical vulnerabilities within less than 24 hours on average, if they are patchable. [3] and [4] Also, don't use Debian or Ubuntu. Security-wise they are a nightmare due to soooooo many wrongly labelled issues, where they put in "too diverged from upstream" and dozens of other freetext-labels as a reason to not fix critical RCEs. Impossible to maintain security-wise. [1] https://www.freebsd.org/security/advisories/ https://www.freebsd.org/security/advisories/ [2] https://www.openbsd.org/errata72.html https://www.openbsd.org/errata72.html [3] https://security.archlinux.org/ https://security.archlinux.org/ [4] https://security.archlinux.org/advisory https://security.archlinux.org/advisory