Flatpak: but it does stop someone installing a keylogger from a ffx exploit Systemd: $ # I use silverblue btw $ THINGS='Protect|Restrict|Capability|Lo

Flatpak: but it does stop someone installing a keylogger from a ffx exploit Systemd: $ # I use silverblue btw $ THINGS='Protect|Restrict|Capability|Lock|SystemCallFilter|Private|MemoryDeny|ReadWritePaths' $ AT='/usr/lib/systemd/system' $ grep -ilE "^($THINGS)" "$AT"/*.service | wc -l 64 $ grep -ilE '^Exec' "$AT"/*.service | wc -l 292 its a bit more than "No Linux distribution actually seriously uses them very much" and it provides a standard solution to "Meanwhile, developers don’t know the contexts in which their software is being run, and need to release portable programs. Developers therefore can’t assume what permissions their program will need with the rest of the system." "and it certainly isn’t as comprehensive as ChromeOS’s minijail." Kinda disagree. - - - Lot of words, no citations for those words. - - - Worth noting that, even among secure options there are points where there is slack: Android uses a uid/gid per app [auid], but chromeos doesn't [cuid] [auid]: https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/Users.md#int-uid https://android.googlesource.com/platform/frameworks/base/+/... [cuid]: https://chromium.googlesource.com/chromiumos/overlays/eclass-overlay/+/master/profiles/base/accounts/README.md https://chromium.googlesource.com/chromiumos/overlays/eclass...