[jbk]

Each subprocess would only get one permission, the one that it actually need. The critical parts (audio decoders, video decoders, parsers) would not get access to $HOME or network, for example.

[laurent123456]

Thanks, that makes sense.