I really wanted to avoid a debate (doubly so in a thread where some dude just wanted some help), which is why I’m trying not to engage the various answers I got; though just one thing since I apparently can’t help myself: Qubes, which you cite, is indeed an example of such improved security done correctly, through an hypervisor and a solid implementation; not cgroups, some duct-tape and the same kernel, and thinking your security has improved. Thanks again, at any rate.