From what I’ve read, thus-far, prohibiting autotools would be a good 1st-step.

Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.

I read an article, a couple years ago, about web-frameworks…

The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit…

Haskell’s got a kind of mantram: don’t bring in a whole framework, just compose what you need, yourself, together.

Its a granularity-difference.

Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn’t interested in Haskell ), is a liability nightmare.

But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world’s security in the ass.

It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.

To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.

That requires limiting what’s included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.

Consistently, at all levels, relentlessly.

It’s a chain: you cannot have a weak-link without compromising the whole chain.

You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.

There are 2 contradictory paradigms: the “magic bullet paradigm”, which doesn’t care how much rot, compromise, anything, so long as they include the “magic bullet” which takes-out the competitor…

… vs the “no weak-points, whatsoever, paradigm”, which doesn’t rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.

They are cultures, not just ideas.

Some people cannot tolerate a “no weak-points” culture, they “NEED” to compromise things ( I don’t care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.

It truly is a culture, or “religion”, and there’s no faking it.

Look to OpenBSD, & see what it takes to be like them…

Many years ago, it was discovered that Wine could run Windows viruses/worms/malware just fine, thank you very much…

“Sandboxing”, it isn’t.

It runs with all the privileges of the user running the app, iirc.

If you have the ability to take a look at either SANS website, and see their articles, or have your system show you all the automatic attacks hitting your machine, then maybe you will understand…

Botnets are coded to hammer-away at all possible internet-addresses, trying to break-in & highjack more machines, to include in the established criminal-machine that the botnet is…

SANS said, a decade or 2 ago, that it took, on average, something like 6 or 4 minutes for a new MS-Windows machine to be owned by some attack from the internet.

I’ve had linux machines cracked/owned, and wiped 'em to get 'em clean.

Having no immune-system is BAD.

Linux botnets, apple operating-system botnets, they exist.

I don’t think there is any operating-system that is connected to the internet that doesn’t have attacks coded to crack it.

I just looked at SANS.org, and they have totally changed, so they are now … more a moneymaking-machine wanting B2B biz?

Here, though, are some cheat-sheets they made:

https://www.sans.org/posters/?msc=main-nav

They used to tell us the top-20 most effective protections for particular threats, identifying how prevalent the threats were, etc…

No idea who does that nowadays…