Good article for what it covers, but sadly does not cover isolation/sandboxing/least privilege.
Indeed. In 2020s, if you're not sandboxing each thing, and then sandboxing each library the thing depends on, you're running with way too many opportunities for vulnerability.
I have no freaking idea. Needless to say I don't think our current operating systems are up to the task of actually being secure. You have to be able to somehow dynamic-link in a library whilst only giving calls into that library certain permissions/capabilities... which I don't think even Windows can do.
Ignorant reply here, but would openbsd's `pledge` and `unveil` sorta cover what you're talking about?