I found an elegant solution for the problem of Haskell vs Linux capabilities explained in "QUIC and Linux capabilities". To know why the CAP_NET_BIND_SERVICE capability is necessary, please read this article in advance. On Linux, the follo…

For security reasons, the typical boot process of HTTPS servers is as follows: Executed by a root. Reading a TLS private key and open a listen socket on TCP port 443. Switching the root user to nobody (or something). Since accept() can cre…