Indeed. Unfortunately it seems nobody in the traditional Linux ecosystem outside Red Hat (and perhaps Canonical's Snap) is really interested in meaningfully imp

Indeed. Unfortunately it seems nobody in the traditional Linux ecosystem outside Red Hat (and perhaps Canonical's Snap) is really interested in meaningfully improving UI application sandboxing. Flatpak is often met with outright hostility and then some ranting about how OpenBSD's pledge already solves all problems. Sure, Flatpak is not perfect yet and too many Flatpaks still have to use filesystem=home (which usually caused by the application or toolkit not being friendly to sandboxing). But the Flatpak folks at least try to gradually improve security. Disclaimer: I mostly run Linux on the desktop. But application security is definitely a blind spot for the Linux community. Many people still seem to think that UID 0 is the ultimate goal. We are mostly protected by the fact that Linux has ~1% of the desktop and is therefore not an interesting target yet.