This however requires that I eschew all of the security benefits of ChromeOS, falling back to the basic Linux security model to protect my Signal chats from eg any package on PyPi (pip supports full package-provided code exec on every install, without sandboxing). While I will
probably end up doing it regardless, this defeats much of the purpose of having a Chromebook
in the first place.
(also, the apt security model where any repo you have configured can replace any package with a newer version (even packages not first sourced from that repo, like distro stuff) sucks really bad.)
This however requires that I eschew all of the security benefits of ChromeOS, falling back to the basic Linux security model to protect my Signal chats from eg any package on PyPi (pip supports full package-provided code exec on every install, without sandboxing). While I will probably end up doing it regardless, this defeats much of the purpose of having a Chromebook in the first place.
(also, the apt security model where any repo you have configured can replace any package with a newer version (even packages not first sourced from that repo, like distro stuff) sucks really bad.)