One thing I quite liked about the sandbox is running marginally (un)trusted code either interactively or as part of some process, and for that sandbox-exec(1) i

One thing I quite liked about the sandbox is running marginally (un)trusted code either interactively or as part of some process, and for that sandbox-exec(1) is great. Security best comes in layers and it's a worthy addition to the toolbox. It's used by homebrew[0] during the build steps, I hear it's in progress for Nix, and I may make use of it in the future for archmac. Unfortunately it's been marked as deprecated in the man page: SANDBOX-EXEC(1) BSD General Commands Manual SANDBOX-EXEC(1) NAME sandbox-exec -- execute within a sandbox (DEPRECATED) [0]: https://github.com/Homebrew/brew/blob/master/Library/Homebrew/sandbox.rb#L5 https://github.com/Homebrew/brew/blob/master/Library/Homebre...