> Sandboxes and containers are what you do when you don't have proper capability models There is no better security than through compartmentalization. The othe

> Sandboxes and containers are what you do when you don't have proper capability models There is no better security than through compartmentalization. The other approaches are through obscurity (doesn't work at all) or correctness (unrealistic). Also, compare the number of CVEs of Qubes and any other system.