Mark Dain I have a crazy idea. Could you run a light OS that has just enough to run a VM which is your actual OS; You use the guest for everything. - The guest needs no special drivers; hardware like Wi-Fi is abstracted away to Ethernet. - You have a "hardware" firewall that malware can't disable; NAT in the VM and/or iptables on host. - You can encrypt the VM's disk if you want/need to. - The host has no services & almost no programs so virtually all infections should be contained to a VM you can roll back to a healthy snapshot. - The host almost never needs to be updated; you can't break your computer in a way you can't recover from.

Martijn Qubes OS is also build specifically round compartmentalising processes through VMs, IIRC. That might be interesting to look at too.

Mark Dain Thanks, I'll check it out; another thing I haven't heard of. I'm glad I'm not the only person who has had this thought pattern!