[pdonis]

> If you're paranoid use flatpak.

I don't think this is a good solution, both because the so-called "sandboxing" isn't all it's cracked up to be, and because you now have to depend on each individual app vendor to push you security updates, instead of just your Linux distro.

The really paranoid would probably be using BSD with jails, which AFAICT is one area in which the BSDs are ahead of Linux.