> 3) it's not about this binary or that its about a secure philosophy.
> Binaries that are for restricted use should echo intended restrictions
> in the access bits.

We do that at work, and in fact have patched some of the binaries in
question locally. We also made *everything* in /bin unreadable unless
it had to be readable for some other reason, and did the same in other
directories. But we're trying for quite a bit more security than the
typical NetBSD system. I don't see that making a handful of programs
that happen to be setuid directly unreadable buys you enough to be worth
the trouble. As I said in another message, provide a script that locks
up the system into a secure state... but default it to avoiding half-
measures.
-- 
Peter da Silva, 77272-0711 USA                  `-_-'
Zure otsoa besarkatu al duzu gaur?               'U`
Serveuse, ce plat bouge encore!

------------------------------------------------------------------------------