Microsoft seems much better at this than the others you mentioned (or Linux). Compatability seems like something that the Qubes model could help with quite a b

Microsoft seems much better at this than the others you mentioned (or Linux). Compatability seems like something that the Qubes model could help with quite a bit. Rump kernels can also help by simplifying the OS level interface to where effective sandboxing is possible. Getting safe and convient access to the data an app actually needs is still a difficult issue. Minus the sandboxing, some package managers are better at this than others, particularly Nix or OpenPandora's PND packages. However, that only helps as long as the OS provides binary compatability. Even with sandboxing, applications that require network access can be a major security issue. It is no consolation to the rest of the network if your botnet node is nicely isolated from the rest of your system. To fix this, applications need to not directly interact with the network but with other system components that do so and can be updated separately. OTOH, often the compatibility loss is independent of the application, either communications standards change or expected features change, so being able to run old applications only gets you so much. In those cases, open source can have a major advantage.