> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. QubesOS does this

> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. QubesOS does this by quarantining your USB controllers in a dedicated virtual machine. https://www.qubes-os.org/doc/usb-qubes/ https://www.qubes-os.org/doc/usb-qubes/ Usb-guard for Linux also uses kernel features to accomplish similar. I dont know of any methods to do this on MacOS or Windows though.