Keep in mind that privilege separation does not cover all possible use cases of sandboxing. Privilege separation is an answer to the question: "I have a progra

Keep in mind that privilege separation does not cover all possible use cases of sandboxing. Privilege separation is an answer to the question: "I have a program whose authors I trust even though they are fallible, and the program needs to process untrusted data" In desktop scenarios, I really want an answer to the question: "I have a program whose authors I don't trust, but I want to run it anyway" For that, you really need full sandboxing; privilege separation is not enough.