[sirclueless]

And in fact, with their sysadmin focus, they explicitly are opposed to this method. If your goal isn't a desktop experience but rather protection from every adversary at all times, then only vetting a small core and letting people run various and sundry packages from third parties is flat-out irresponsible. But of course this is what desktop users want -- to run any software they like with no hoops to jump through or update schedules to keep on top of, so they will always be at odds.