For example, by default you need to be root to listen to network ports below 1024, meaning that nearly ALL default network programs on your server need to at least have elevated privileges while starting up (or need some sort of port forwarding stuff thats inflexible, awkward and easy to get wrong).

See below the line.

This is especially annoying and potentially dangerous when you are actively developing software (like a webserver or a nameserver).

Right.

I usually run my system with net.ipv4.ip_unprivileged_port_start=0. This way no more root required to run your DIY webserver or nameserver (or to debug them in the IDE).

And so, even the least privileged user can run DNS, Mail, Web, FTP, whatever servers. That's not secure.

Savely starting an unprivileged TCP server on a privileged port (i.e. port < 1024) that entirely runs without root privileges is a solved problem. You need a tiny privileged program that opens the socket, then drops privileges, and finally exec()s the real server that inherits the opened socked filehandle to listen on that handle.

Alexander