I am far from a blackhat/malware expert, but I've used enough ASLR exploits with ROP toys to win a few CTF's. I'm way too old to have any allegiance to BSD vs Linux vs POSIX{foo}. I say this to clarify my point - in the 90s I was a teenage-FreeBSD bigot; now, I don't give a hoot. To successfully manipulate the lack of memory address randomization (i.e., attack via ASLR), one either either has a target running BIND circa 1999 that will let you smash the stack and 'sploit da EIP remotely, or the malicious attacker has a local, non-jailed shell. At which point you have far more to worry about than ASLR. DEP and ASLR are effective (especially with doing interesting things more advanced than just swapping on a ROP gadget - JIT stream exploits are _very clever_) but I'd take the out-of-the-box FreeBSD over any distro of Linux out-of-the-box for security.

There is a working ASLR patchset for FreeBSD.

https://hardenedbsd.org/article/shawn-webb/2015-07-06/announ...

So if you want ASLR you can have it. It's just not yet in a regular FreeBSD release.

To be honest, FreeBSD lack so many other modern features that barely makes it usable. (Properly working)NUMA? Virtualization? Yes, I'm fully aware about work in progress.