> In a few minutes I could whip up a VSCode plugin that sends me your browser session storage and have access to all of your everything. Yeah I know but I’m sa

> In a few minutes I could whip up a VSCode plugin that sends me your browser session storage and have access to all of your everything. Yeah I know but I’m saying despite that Linux is more secure in practice. Most software is not distributed as some random VS code extension, but as FOSS projects and all the checks and balances of the distro maintainers. That’s who keeps you safe at night, and it works remarkably well. Capability permission in all glory but it’s not a panacea. What happens in practice is that an app asks for permission to your bank account and eternal soul, and then users say “well, I guess I need to if I want this Instagram filter” and there you go. So it’s not as easy as retrofitting sandboxing onto the OS. Neither am I claiming it’s easy to solve. What I am saying is the App Store model is largely security theatre.