zwass though on the priv sep, had time to think about it: priv sep is cool if you need a limited amount of privileges (read syscalls) so that the surface to exploit in privilege code is limited and the non privilege code has limited access to other syscalls/privileges. Problem here is that if privilege separation is implemented, the non privilege prt of the code would still be able to query a very large amount of privilege bound resources hence limiting very much the protection