Free tools Windows power users keep installed
One-click scans. No signup required.
No—the available evidence does not establish that the BSDs are dying. The concern traces to a 2017 review of FreeBSD, OpenBSD, and NetBSD that raised questions about security scrutiny and the size of their developer communities. It is a meaningful sustainability debate, but it is not a current census of BSD activity or proof that the projects are near closure. Security findings, project visibility, and the health of a particular maintained system are separate questions.
What prompted the claim that the BSDs might be dying?
A 2017 CSO report covered security researcher Ilja van Sprundel’s review of FreeBSD, OpenBSD, and NetBSD. He argued that his review uncovered old bugs and that smaller developer communities could mean fewer reviewers, slower discovery, or delays in adopting security features.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The Design and Implementation of the 4.3 Bsd Unix Operating System: Answer Book | $7.49 | Buy on Amazon |
| 2 |
|
UNIX and Linux System Administration Handbook | $65.12 | Buy on Amazon |
| 3 |
|
BSD UNIX Toolbox: 1000+ Commands for FreeBSD, OpenBSD and NetBSD | $16.99 | Buy on Amazon |
| 4 |
|
Unix in a Nutshell, Fourth Edition | $19.13 | Buy on Amazon |
| 5 |
|
BSD Hacks | $14.78 | Buy on Amazon |
The report also included responses that qualify that argument. NetBSD’s Taylor R. Campbell said NetBSD 7.1.1 already included patches for issues discussed in the review and noted that many findings involved binary compatibility layers requiring local access. FreeBSD’s Ed Maste said some reported issues lacked practical exploits and that the project had begun treating some as bugs rather than security issues. Those were responses to the findings at the time, not assessments of every BSD system today.
These perspectives point to a real question—whether projects have enough people and resources to review code and respond effectively—but a bug count alone cannot answer it. A finding’s affected release, attack conditions, severity, patch status, and practical impact all matter.
What does “dying” mean, and what evidence would show it?
“Dying” can refer to declining public attention, fewer contributors, shrinking deployments, reduced support, or an imminent end to development. Each claim needs different evidence. A 2017 report about security findings cannot establish a current trend in all of those areas.
The evidence available here does not provide a common current dataset for contributor counts, deployment numbers, support commitments, or patch response times across FreeBSD, OpenBSD, and NetBSD. It therefore cannot support a confident ranking of the three or a conclusion that they are all thriving—or all in decline.
Visibility is also an imperfect proxy for use. In a 2025 essay, the FreeBSD Foundation argued that permissive licensing can let organizations build on FreeBSD without returning code or publicly identifying their deployments. That is the Foundation’s explanation, not an independent measurement of how widely FreeBSD is used.
How should BSD security findings be judged?
A researcher’s bug count and a project’s published security-advisory count are not necessarily comparable. Projects have criteria for deciding which issues warrant advisories, and a finding may require local access or lack a practical exploit. To evaluate a claim about security, look at the details rather than treating every finding as equivalent.
- Affected code and release: Identify the component and versions involved, and whether supported releases received a fix.
- Attack conditions: Distinguish remote attacks from issues requiring local access or other prerequisites.
- Severity and practical impact: Consider what an attacker could actually do, not only whether a defect exists.
- Disclosure and remediation: Check when fixes were issued, how they reached supported releases, and what the project’s advisory and update process covers.
- Review capacity: Consider code review, testing, and independent scrutiny alongside the findings themselves.
FreeBSD’s security information page, marked modified September 5, 2026, describes categories the project generally considers for security advisories. They include privilege escalation, code injection, memory disclosure, certain remotely exploitable denial-of-service issues, unassisted jailbreaks, and failures that could produce insecure cryptographic keys. The page also directs users to advisories, errata, release-support information, and updates. Advisory totals should therefore be read in light of the project’s criteria, not as a complete count of every bug researchers might identify.
What recent FreeBSD evidence says—and what it doesn’t
A 2024 audit found real weaknesses and recommended further work
The FreeBSD Foundation’s November 2024 audit of Capsicum and bhyve describes vulnerabilities in both subsystems and says fixes were released in groups. It recommends ongoing improvements to code inspection, tooling, testing, security training, and support. The report also states, “No specific metrics have been extracted from the audit results at this stage.” It is evidence of weaknesses and remediation in the audited subsystems, not a measurement of all FreeBSD security or a comparable audit of every BSD.
Rank #4
A 2025 infrastructure project shows investment, not a portfolio-wide trend
The FreeBSD Project’s Q1 2025 status report described an infrastructure modernization effort commissioned by the Sovereign Tech Agency with a budget of $745,000, as reported by the FreeBSD Project in 2025. Planned work included security tools for the base system, ports, and packages; development infrastructure; build security; and contributor onboarding. This is evidence of one named FreeBSD effort, not a measure of investment across FreeBSD as a whole or across all BSD projects.
FreeBSD has a stated security role, but that alone does not prove capacity
In a FreeBSD Forums interview, Security Officer Gordon Tetlow described the role this way: “The security officer has an open-ended charter to make things secure, which includes the ability to override actions and decisions of other developers if necessary, in the name of security.” That statement explains the authority assigned to the role; it does not establish how much staffing or review capacity is available in practice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
What can readers reasonably conclude about FreeBSD, OpenBSD, and NetBSD?
The strongest conclusion is limited: the 2017 review raised legitimate questions about security scrutiny and community size, while project representatives challenged how some findings should be interpreted. Later FreeBSD sources show an active advisory process, an audit that identified vulnerabilities and recommended improvements, and a funded infrastructure effort. They do not establish the present health of every BSD project or prove that security capacity is sufficient.
For someone choosing or maintaining a system, evaluate the particular project, release, and workload. Check whether the release is supported, review its advisories and update process, and apply relevant fixes. A broad claim about “the BSDs” cannot substitute for those concrete checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
