On 20 October 2026, a Tuesday, a commit went into FreeBSD's source tree with the title pf: Keep every chunk of a table that a ruleset defines. The message explains the bug in four sentences. The library that talks to the firewall, libpfctl, sends a table of addresses to the kernel in chunks of 256; the kernel treated each chunk as a fresh definition and replaced what it had, so only the last chunk survived. The fix marks every chunk after the first, teaches the kernel to append them, keeps old kernels working, and adds a test. Seven files: one in the library, four in the kernel, one header, one test script. One author, one review, one commit.
That bug lived in the gap between a library and a kernel. On most systems that gap is a border between two organisations, and this piece is about what it costs to live on one side of it.
The model, and why it exists
A Linux system is assembled. The kernel comes from kernel.org, the small commands from GNU or elsewhere, the init system from the systemd project, the C library from a fourth, and a distribution takes a few tens of thousands of such parts and makes them agree. Debian's own page says it is done by "more than thousand active developers spread around the world", all volunteers, and the main archive for Debian 13 on amd64 holds 68,825 binary packages built from 37,478 source packages.
The reasons for the arrangement are respectable, and they deserve stating before the bill. Every project keeps its own pace, its own review, its own taste and its own release day, which is how specialists end up writing the specialist parts. A distribution can choose the best tool for each job, whoever wrote it. Many eyes see more. And Debian in particular has built a quality apparatus of its own around the assembly, a written Debian Policy, reproducible builds and automated tests under autopkgtest, that no single upstream could afford. Melvin Conway wrote in Datamation in April 1968 that "organizations which design systems … are constrained to produce designs which are copies of the communication structures of these organizations", the observation that later took his name as Conway's law. The assembled model takes that as a description, and the distributions have made a living out of being the communication structure.
What one server is made of
I took the smallest thing Debian ships that is meant to run a service, the Debian 13 genericcloud image for amd64, and resolved its manifest against the archive on 21 October 2026. It holds 322 packages. They come from 216 source packages, carry 129 different maintainer entries, people and teams, and point, by their homepage fields, at 94 different upstream hosts: 63 on GitHub, 23 at gnu.org, 11 at systemd.io, six at freedesktop.org, six at netfilter.org. 434 MiB installed. Every one of those 94 is a project with its own bug tracker, its own release day, its own licence and its own idea of what a stable interface is, and every one of the 129 is somebody who translates between that project and the rest of the system.
None of this is hidden. Debian's bug tracker has a field for it: a bug that turns out to belong upstream is marked forwarded, with the address of the other tracker, and it waits there. The Debian bug tracking system is where the assembled model is candid about itself: what moves is the responsibility, and the bug waits where it was.
What a seam costs
Two cases, both documented by the people who lived them.
The first is a firewall. nftables, the successor to iptables, was merged into Linux 3.13 on 19 January 2014. It became Debian's default framework with Buster in 2019, five years later, with an iptables-nft compatibility layer so that tools written for the old syntax would keep working. In October 2026, ufw, the default firewall tool on Ubuntu, still writes iptables syntax and lets the layer translate it. That is one change, three organisations, twelve years and a translation layer, and the layer is what the administrator runs in the meantime. A firewall change on FreeBSD is in the next section.
The second is sshd. The OpenSSH project never linked its daemon against the systemd library; Debian and others patched it in, so that sshd could tell the init system it was ready to accept connections, and libsystemd in turn depended on the compression library liblzma. On 29 March 2024 Andres Freund wrote to oss-security about a backdoor he had found in that compression library, and put the seam in two sentences: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma." Nobody in the chain had done anything unreasonable. The daemon's authors had not asked for the library, the library's authors had not asked to be inside a daemon, and the distribution had done what distributions do. The fix came in July 2024, in OpenSSH 9.8, whose release notes record support for "notifying systemd on server listen" without linking the library at all; it had to come from the one party that could change the daemon itself.
So the bill is this. The projects keep their autonomy, which is what they wanted. The distributions keep the integration, which is their product and, for the commercial ones, their business. The administrator pays at the seams: a bug with two owners, a fix that travels through three trackers, a feature that spends a decade in a compatibility layer, and a patch written by somebody who was not responsible for either side of it.
One tree
FreeBSD's source tree holds the kernel and the userland in one repository, and has done since the project began in 1993. The contributors list names 403 people with commit rights across the three trees, source, ports and documentation; a Core Team of nine, elected by the active developers, sits at the top; a Security Team of nine, with one Security Officer, writes every advisory; a Release Engineering team of eleven ships every release; three people run the bug tracker as Bugmeister. That is the whole organisation chart for an operating system.
The team does not write everything itself, and the count says so. The tree imports 119 third-party components: 92 under contrib/, 22 under sys/contrib/, five under crypto/, among them LLVM, OpenSSH, OpenSSL, OpenZFS, xz and the time zone database. The Committer's Guide prescribes how: each arrives on a vendor branch, where "it is critical to verify that the source code you are importing comes from a trustworthy source", and is merged from there into the tree, after which it is built with the kernel, tested with the kernel, released on the kernel's day and patched through the same advisory as the kernel. The upstream keeps its autonomy; the seam is inside the tree, where one team can see both sides of it.
What that buys is visible in the commit log. On 23 September 2026 Kristof Provost converted one of the firewall's control operations from the old ioctl interface to netlink: seven files, in sys/netpfil/pf, lib/libpfctl and sbin/pfctl, kernel, library and command in one commit. Four weeks later the chunk bug above was found by R. Christian McDonald and fixed the same way, with the test beside it. The equivalent on Linux, moving a firewall's control path to a new interface, is the twelve-year story in the previous section.
The difference, shown
Debian 13 cloud image FreeBSD 15.1 base
source packages 216 one tree
maintainers of record 129 people and teams 403 committers, one project
upstream projects 94 hosts, each on its own 119 imports on vendor branches,
release schedule built and released with the tree
a bug between library and kernel two owners, one "forwarded" one commit, seven files, one test
a security fix in a shared library per distribution, own date one advisory, every release
a new firewall control interface 2014 kernel, 2019 Debian, one commit, 23 September 2026
2026 still translatedCounted on 21 October 2026 from the Debian cloud image manifest and the trixie package index, from freebsd.org/administration, the contributors article and the releng/15.1 tree, and from two commits in the public log.
The limit
One tree still carries 119 imports. LLVM, OpenSSH, OpenZFS and xz come from outside, and when xz ships a bad release the vendor branch receives it like anyone else; what changes is that one team integrates it and the same team answers for it afterwards.
Fewer people. Against Debian's thousand-and-more and the upstreams behind them, 403 committers hold the tree. The FreeBSD Foundation funds what the volunteer count leaves undone, and the model holds because the base is small enough for one team to know, with the ports collection carrying the rest of the software world as an assembly like any other.
Debian's quality apparatus is real. A written policy, reproducible builds, autopkgtest and a bug tracker that forwards upstream are more process than most single projects maintain. The seams are counted here, and they are attended.
Conway cuts both ways. A system that copies one organisation's structure copies its blind spots too, and whoever disagrees with the Core Team has to persuade it; the ballot that elects the Core Team is where that argument is settled.
The bill
The assembled model gives every project its freedom and every distribution a product, and it sends the invoice to the administrator, who pays it in the places the chart does not show: between the daemon and the library, between the kernel and the tool, between the tracker and the tracker it forwards to.
FreeBSD pays for the same software once, inside one tree, and the Tuesday commit is what the receipt looks like: a bug between a library and a kernel, found, fixed and tested by one person in one afternoon, with the old kernels kept working because the person could see both of them. Conway said a system copies the organisation that builds it.
One of the two was built to take that as a compliment.