Post #3331112

I personally go with QubesOS which uses VMs to compartmentalize. It doesn’t reduce the risk of a supply chain attack itself (fedora & debian by default), but if your VMs only contain the bare minimum for a given task the risk of having a compromised package installed is lower than in a full-featured system and any compromise is also contained to that VM.