[haertig]

If I want to do something that I consider unknown and potentially insecure/risky, I first boot my computer from a thumbdrive and load the entire OS into RAM. Then I pull the thumbdrive. No writable storage media is present - no hard drives, SSDs, thumbdrives, microSD cards, etc. When booted this way, I have the computer on it's own separate VLAN - networking is only allowed to the WAN (internet), not to any of my other VLANS containing other computers or devices. As a bonus, when everything is in RAM you are using a layered file system so that if you want to see exactly what a suspicious program does to your computer you can look at the proper layer individually. Power cycle the computer and reboot normally to clear out RAM and any insecure/risky stuff that may have inserted itself there when you want to go back to normal mode.