Right now I'm using
cap_net_bind_service MY_USERNAME in /etc/security/capability.conf.
Now I just need to set
cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to add
CAP_NET_BIND_SERVICE to the effective set via libcap[-ng].
This works fine, but I wonder if there's a way to achieve the same thing without setting any caps to the interpreter binary. While it's not a big problem (other user accounts don't have the cap so they can't use it even with the bit set on the interpreter binary) it's somewhat annoying since I have to re-set the flag every time the interpreter is updated.