Embed Notice

@protonmail @esm @hexaheximal

4. It's easier to audit a small, native app and even sandbox it into a single user that has literally 0 privilegues because a higher layer that doesn't allow said user to interact with it constricts it.

[Thats's literally done with #Webservers and #Databases where they're run as dedicaded users which have no privilegues excpet their own use-cases