> You can't even tell whether a given symbol looked up with dlsym is a function or data!

On many modern unixes you can! Functions will usually be in a "text" section (marked execute or read+execute) and data will usually be in a "data" or "bss" section (marked read-only, or read-write).

The dl* family of functions don't expose this information, but after getting a symbol you can check the protection bits on the page the pointer is on (using a system-defined mechanism).

Data could be placed into protected space. I think that a string literal in .text space could be exposed as a dynamic symbol.

It is not a quirk, it goes back to how Windows did dynamic libraries on Win16 and everyone had to use them, specially when linking at compile time.

Also it was how Symbian and Aix did dynamic loading as well (Aix eventually adopted other UNIXes model).