Earlier quoted context omitted.
To be fair, Linux and friends aren't much better in that regard. Permission management for locally running programs is pretty much poor by default in all major operating systems. SELinux and AppArmor for Linux improve on the situation, but they're usually not the default unless you're using Fedora, and even there, it might need some extra configuration. I'm looking forward to capability-based systems with microkernel…
> To be fair, Linux and friends aren't much better in that regard. Linux gets there a different way. The standard way to install applications is from the package manager and essentially all of the applications in there are trustworthy (because they're all open source and if they did anything seriously user-hostile, someone would fork it and that version would be the one in the package manager). Meanwhile the package…
The difference is that Linux repositories are less noteworthy to attack, have a more distributed culture not ruled by capitulating lawyers, and can actually jurisdiction shop.
The ultimate problem is a lack of a cross-software security model of the OSs, Linux included. User-based isolation is cool and all, but orthogonal to the modern world [0]. For decades we've been continually looking for better ways of isolating local apps, while also rejecting centralized control. We keep looking, while centralization keeps ratcheting.
I'm still hopeful that a well done capability (handle-based) system would go a long way, but not fully solve it. Unfortunately that means shedding off POSIX/LSB rather than duplicating the entire monolithic OS environment for every security context.
[0] Where say even a local LAN IP address is security-critical information!