[tptacek]

This is an incoherent response. Privilege separation is orthogonal to async designs. It's just as easy to privsep a synchronous program. Meanwhile, while I happen to appreciate async designs, it's far from settled as to whether they're long-term sounder than thread. What I know from experience is that it's easier to make async designs performant. Nothing I've seen suggests that they're that much safer.

[bananas]

Sorry I agree it was rather incoherent - I was distracted half way through posting.

I'm not suggesting they are sounder but I'm suggesting that async designs are simpler and simplicity rules when it comes to safety. sync designs tend to evolve into complexity over time to maintain performance (IIS for example which is a behemoth of threaded privsep pain).

And in my experience (so totally an anecdote and I accept that), it's not easier to privsep a synchronous program. On top of the IPC concerns of isolation, you still have all the problems associated with threading. It's just pain.

(I've written a fair number of both types of systems - none open source unfortunately)

[tptacek]

The original privsep programs weren't async reactor-based designs.

[bananas]

No they were single threaded forked. Aware of that.