Hacker News Reader

>it can read other process memory and all the files owned by your user

Tools like flatpak and bwrap exist. A process in a bwrap sandbox can't read other processes memory or any files that I didn't bind into the sandbox.

If I want to run an X11 GUI app in a sandbox, it can trivially escape. Wayland makes it possible to do this without a trivial escape.

Also, processes cannot read other processes memory without being a parent process or something, or having root, and with bwrap they can't even see other processes running on the system at all.

With this kind of logic, you don't fix any security hole, because you can't fix them all at once.

You can use linux namespaces or a tool like bubblewrap to sandbox the process which makes it reasonably secure. However if you're running a GUI app that rendres to an X11 server all your security gains go out the window.