> But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. Anything with an

> But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. Anything with an attack surface also must not be able to replace its own binaries/code. Otherwise a one-time exploit is instantly updated to a permanent infection.