@cult how do you bind to :631 as non-root? CUPS itself would need to drop privs but it doesn't have that capability. It's completely missing from cupsd.conf

I could work around it and allow cupsd to bind to :631 as non-root on FreeBSD pretty easily, but that's a much harder problem on Linux these days. Linux's option for this (CAP_NET_BIND_SERVICE) requires you to bless a *binary* to bind on reserved ports, not a user or group.

If you want to do it with a user or group you have to wrap the command with something like authbind which is not a transparent change at all