This is why Linux should be taking things like the xz exploit more seriously and, at least, adopting a solution like firejail or bwrap everywhere. It's not a p

This is why Linux should be taking things like the xz exploit more seriously and, at least, adopting a solution like firejail or bwrap everywhere. It's not a perfect solution, but it's a step in the right direction towards patching the Unix model, so that programs don't have privileges they don't need. Mobile Linux (Mer / SailfishOS) works this way to mimic app-based architectures. But, unlike Android, it still feels like regular Linux.