I didn't know a pdf reader will download and execute arbitrary code if the document asks it to. Not delighted about that. I think someone could guess a coworke

I didn't know a pdf reader will download and execute arbitrary code if the document asks it to. Not delighted about that. I think someone could guess a coworker's email and send a malicious file that claims to be from them with a very high hit rate. Does Linux have a not-insanely-annoying means of sandboxing applications yet? E.g. so evince doesn't get to talk to the network or write files, even if it asks nicely.