From: David Leadbeater Subject: Re: httpd(8) log files are world and daemon-readable To: Brian Brombacher Cc: Piotr Durlej , tech@openbsd.org Date: Fri, 28 Aug 2026 12:48:24 +1000 On Thu, Aug 27, 2026 at 08:33:29PM -0400, Brian Brombacher wrote: > What stops your malicious local users from running netstat -an in a > tight loop and recording every connection timestamp and IP address? > There goes your “GDPR Compliance” out the window. On one shared system I force untrusted users into a different rdomain(4) via SSH config, the intent isn't to hide netstat output but it is a side effect. Obviously things like cron escape the SSH rdomain configuration, so you then have to consider those cases and handle them somehow too. > Your threat model is fundamentally flawed. Don’t mix candied apples > with anchovies and expect something edible. Don't expect it to work out of the box but I wouldn't say fundamentally flawed. Many things are configurable.