Guess the old replies to that of "oh, but it's open source! Anyone can see the code...so there's no need for security because the OS is secure because anyone can see the code! See? Any bugs and they're fixed in like hours. Don't worry!"

At least that's what I used to hear all the time. We've now seen that was hogwash.

AppArmor, sandboxing, jails, chroot.. what other feature do you want?

Linux will let you have the most locked down box in the world if you want.

The only linux distro that has meaningful security is android.

Linux sandboxing scene is completely broken for end-user usage, it’s only good for CICD pipelines. If I want to open a file with a program, I don’t want to see an empty drive, neither do I want to kill the program - there should be a proper interaction between the user and the program, like mobile OSs do. Flatpak does have something like that, but only for files and not even that is seamless (plus flatpaks mix packaging with security for no good reason, imo).

You literally run basically everything as the same user, every document, family photo is saved, and thus available for r/w by any process, as those share the exact same privilege. This includes that npm install with millions of dependencies as well, that could literally install a screensharing malware with clear access to any internet site and you wouldn’t even notice.

The age-old xkcd is still true: the only thing secured is being able to install a video driver.

Flatpak works fine for this. The discord flatpak only has access to my downloads. If I want to tweak that, I run the flatpak customizer UI. It's sort of vaguely annoying to have to restart the app.

Or I just run it in docker and only mount what I want. No VM overhead since cgroups are native.

What you are suggesting is basically to write the code yourself. That's equivalent to "Linux distributions do not have proper security out of the box".

Nowhere did I suggest anything involving touching code or even raw config file.