systemd
- Hardening the box you're logged in through
Earlier that night I killed the poller that would have proved me wrong. Under twenty minutes later, the changes went in with their tests written first.
- Transmission is a remote-code-execution box by default
Transmission runs a script of the RPC caller's choosing when a torrent finishes. Seccomp can't block that exec; a systemd sandbox can make it worthless.