> In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of some

> In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of something like Firefox, distros are barely vetting anything, and are reluctant to patch because such patching rapidly becomes unmaintainable. Most dependencies don't end up unbundled, either. So distribution Firefox packages are really external packages in distribution package clothing, more so than any other package, really. This is why I want sandboxing anyway - because I understand the limits of what is practical. And sandboxing and limiting interaction through well-defined interfaces is better for security anyway, because security vulnerabilities happen regardless, and sandboxing does provide some level of mitigation. Finally, the distribution packaging model is insufficient for many users. Even if you are fine with it, most users want something newer than their distribution release, and we can see that they are prepared to give up security and system stability for it. This is a real need for these users, and sandboxed third party packaging mechanisms provide a real solution for them, even if you can manage without.