most companies i've worked for have special packages for perl/python/php/etc that compile the interpreter without support for system calls, for example. That a

most companies i've worked for have special packages for perl/python/php/etc that compile the interpreter without support for system calls, for example. That alone have probably paid of handsomely over the years considering all the XSS we patched, which could very well have been full network compromises.