Correct! A system can only reveal information it knows, so to defend against this "attack vector" when building a secure system, you must ensure that the softw

Correct! A system can only reveal information it knows, so to defend against this "attack vector" when building a secure system, you must ensure that the software knows as little about the system as possible. There are various ways that don't require NAT, it's more a matter of ensuring the software doesn't need the information it shouldn't know. And both FreeBSD and Linux have tools to lock down a process so it can't find these out (Capsicum and/or SELinux).