consumer demand for malware-free (but not vendor spyware-free) platforms is driving this in a big way The thing is, you can eat your cake and have it too. Vari

consumer demand for malware-free (but not vendor spyware-free) platforms is driving this in a big way The thing is, you can eat your cake and have it too. Various distributions (e.g. Ubuntu and Fedora) already use secure boot to verify the bootloader - kernel - module chain. There is no reason that this couldn't be extended to e.g. only running signed Flatpaks too. And yet, at the same time, you can boot these distributions without secure boot, load unsigned kernel modules, etc. It is true that a combination of code signing and sandboxing provides a lot of additional protections. But a less consumer-hostile flavor could be where by default the system is restrictive, but the user always has the power to disable certain or all security mechanisms. The problem is that it is not only about security and protecting against malware for these vendors. It's also about funneling applications and subscriptions through their app stores, so that they can take their 30% cuts. They don't just want to profit from the initial sale, but also the continued use of a system. The security argument is just used to trap users in their app store ecosystems. What makes this more unfortunate is that a large contingent of the Linux community is opposed to better security measures by default. This is why many Linux distributions are still stuck in a 90ies threat model where gaining UID 0 access is what one should protect against, while applications can freely roam in users' home directories. Consequently, there are only few Linux distributions that are competitive to iOS or macOS when it comes to desktop security.