privoxy - why LaunchAgents, not LaunchDaemons? about macos-security-and-privacy-guide

[drduh]

This is how it was recommended in Homebrew, I guess because most people run as single-user admin. Correct me if I'm wrong, but dnsmasq and dnscrypt are recommended as launch daemons because they run on privileged port 53. Anyway, running privoxy as a launch daemon so it's available to all users is probably fine, however you should probably look at its bug tracker and source code to determine it's trustworthiness to run as root.

[dnwe]

Minor addition to this. If you don't need a low-range port then you can create a non-privileged user 'privoxy' and add that as the UserName key for the launchdaemon. That will give you the all-user service at boot without any risks associated with running as root.

[dnwe]

Being paranoid, even dnscrypt could be run on a higher port as a non-privileged user, as only dnsmasq actually needs to be on port 53 and even that could be avoided with some pf rules.