You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over. First, the GRSecurity patchset contains a

You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over. First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface: 1. https://wiki.gentoo.org/wiki/Allow_only_known_usb_devices https://wiki.gentoo.org/wiki/Allow_only_known_usb_devices Clearly this only helps Linux people. For those using Linux/BSD/macOS, There's also usbkill, a Python-based antiforensic tool that just kills the computer if a device is inserted/removed that isn't on its whitelist: https://github.com/hephaest0s/usbkill https://github.com/hephaest0s/usbkill While this won't stop Samy's box from starting to do its thing, it will at least shut the computer off and mitigate some of the potential damage. usbkill is in the Homebrew repositories for macOS as well. If you have fully encrypted disks and strong passphrases, this is still going to ruin somebody's day trying to use this device.