On #1, totally agree, and security systems can add an extra winkle... With code-signed binaries on a Mac, macOS Gatekeeper caches signatures by inode. If the b

On #1, totally agree, and security systems can add an extra winkle... With code-signed binaries on a Mac, macOS Gatekeeper caches signatures by inode. If the binary is replaced/re-written in a way which retains the old inode, and you try to execute it, the OS will SIGKILL the process immediately. Not fun to debug the first time you encounter it!