Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model. I agree. For instanc

Both of these issues seem like a timely reminder that everyday Linux desperately needs a proper application management and security model. I agree. For instance, on recent macOS versions you cannot modify most system directories as root, unless System Integrity Protection (SIP) is enabled [1]. SIP can only be disabled by the user by booting into the recovery OS. Just making these directories read-only prevent accidents and malice. AFAIK in Fedora Atomic Host/Server some system directories are also read-only [2]. Moreover, Fedora Atomic uses OSTree as a content-addressed object store, similarly to git, where the current filesystem is just a 'checkout'. So, you can do transactional rollbacks, upgrades, etc. [1] https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899 [2] https://rpm-ostree.readthedocs.io/en/latest/manual/administrator-handbook/#filesystem-layout https://rpm-ostree.readthedocs.io/en/latest/manual/administr...