@feld @helene pledge and capsicum are not that comparable. pledge is just a syscall or something that drops privileges when you call it so it's easy to do in a C program. openbsd refuses to implement capabilities or mandatory access controls because they believe in practice they are too complicated and therefore used incorrectly. I have mixed feelings about that assertion.