[blattimwind]

One really obvious thing that occurs to me is that apt uses separate processes for network I/O but fails to reduce their privileges.