I would love to see no_new_privs more widely used, so thanks! Unfortunately it should be noted on most distributions this will cause counterintuitive breakages

I would love to see no_new_privs more widely used, so thanks! Unfortunately it should be noted on most distributions this will cause counterintuitive breakages -- most notably ping won't work for unprivileged users (but luckily you can fix this by changing net.ipv4.ping_group_range to include the unprivileged user groups -- I hope distributions fix this eventually...).