1. restrict outbound connections by binary.

2. restrict outbound connections to known malicious IPs or domains.

3. run untrusted code/apps:

   - under a different user
   - or inside a sandbox
   - or in a VM

4. remove exec permissions to temporary directories (/tmp, /var/tmp, /dev/shm)