Hacker News Reader

You can harden your system using hidepid.

Chapter 4.1: https://www.kernel.org/doc/html/latest/filesystems/proc.html

My point: why isn't this private __by default__?

(Also, I fear that by setting this flag it will break a lot of tools that expect the flag to be 0)

On FreeBSD there's a sysctl to control it and there's a kernel module you can configure to allow specific UIDs/GIDs to see everything so you can still allow your monitoring tools to do their job without being root, for example. It's a standard config in places I've worked

Reply on news.ycombinator.com