Downvoters, consider reading first: https://madaidans-insecurities.github.io/linux.html

windows sandboxing btw. is barely at use. every program can basically read everything in user profiles, that is imo the same on linux.

only windows applications that do not run in full trust mode, like store apps won't do that. and even without store apps you can use something like msix or app-v to package your apps in a "small" sandbox, but you can breakout from the sandbox via runFullTrust

Regardless of what mitigations Windows has in place, when you run closed source programs, without competent security auditing you never know what it's doing. Once you click run your precious user files are always in jeopardy. Even with GUI isolation, a point of contention in the article, it's trivial with a few bytes of code to implement some other form of keylogging which the user will run without much thought because hey, it's Windows, it's "secure" while having no real idea what the program is doing in the background. To reiterate, any execution of closed programs will result in execution of closed processes.

With the Windows model, you don't check your guests at the door. You can't search all guests so you assume all guests are hostile and with it you're always taxed with playing security theater which can not only be expensive in terms of hardware resources but mental resources as well as losing more control over your own environment. Because you let unaudited people in your home, before long you have to lock down most parts of it, even from yourself. In gaining control you've lost control because you don't control for openness in the first place. For the few binaries I run on Linux I sandbox them in a VM anyway. But different models, different hosts, each has their weaknesses.

Most importantly, how do you check the binary you are running is actually built from the source code the vendor says it is if the source is not open ?

They might sincerely thing so, not knowing they were targeted and now all the binaries they ship are also containing a payload added by the attacker.

With open source software and especially the Linux distro model where one set of people writes the software and another buikds it from source and integrates it is much harder if not impossible to pull off such an attack affecting all users of a piece of software.

That article is comes from an extremely naive security posture.

I'm curious whether somebody will challenge it