I used to, but I don't have convenient sandboxing set up, and now I'm too scared of what the world has become to run native apps that don't come from a well-kno

I used to, but I don't have convenient sandboxing set up, and now I'm too scared of what the world has become to run native apps that don't come from a well-known-and-trustworthy distribution method -- whereas, I trust my browser enough to visit links I find or are recommended to me by people I know (though there's still a chance of zerodays, etc.) How do you keep your native apps well behaved?