>Linux distros are behind on implementing modern binary exploit mitigations. Compile from source, use only trusted package managers, and sandbox and compartmen

>Linux distros are behind on implementing modern binary exploit mitigations. Compile from source, use only trusted package managers, and sandbox and compartmentalize when possible. >Linux distros have no concept of sandboxing They may be inadequate or need improving, but these concepts are there, if rarely used by default. >Any app running under Xorg can see the contents of any other app runing under Xorg. There are ways to prevent this without saying "Wayland". >The only good sandoxing API provided by the Linux kernel is seccomp-bpf, and the only program that uses it is Google Chrome/Chromium. The very link to the wikipedia entry for seccomp shows otherwise... >Also a friendly reminder that Debian is always behind on CVEs, and I'm sure that most distros don't fare any better. This is a good point, and one of the reasons I think that the future will belong to rolling release style distros with a faster CVE cycle. Just the few things that stood out to me, not a piece by piece analysis.