There's three that I can see: 1. Walled Garden: Developers don't self-publish. Call it an app store, call it everything-in-apt. 2. Encapsulate everything so t

There's three that I can see: 1. Walled Garden: Developers don't self-publish. Call it an app store, call it everything-in-apt. 2. Encapsulate everything so that developers can't do anything. Don't use anything unless it comes in a docker instance. Or a FreeBSD jail. Or something else. Qubes maybe. 3. Smarter users. Good luck with that one.