ports does have the separation, you fetch/build as the local user and run install escalated.<p>running a fetch as root or blindly changing the permission structure of /usr/local should scare everybody.