I think this and sibling captures the difference quite well. For your hex editor, you could replace it with an image converter service - each image conversion n

I think this and sibling captures the difference quite well. For your hex editor, you could replace it with an image converter service - each image conversion need to open a source file for reading and a destination file for writing. You could limit the converters access to not read /etc/shadow various static ways. But assuming uploads/malicious.jpg blows up, it's tricky to statically say: deny access to uploads/other_user_medical_bill.jpg. So the example isn't all that contrived. Run time dropping of privileges is very useful (and common for network daemons etc for a long time - like apache binding port 80, maybe opening log files, then dropping from root to nobody/www data). But being able to say that "after this point I should never have to open a file" and having that pledge enforced - is really nice. This is a tool for good programs to behave in the face of bugs, while static measures are a way to enforce access on potentially bad programs.