I only have limited trust. Between 3D printing slicers from Chinese companies, many packages from PyPI and Rust crates, there is always a danger that something

I only have limited trust. Between 3D printing slicers from Chinese companies, many packages from PyPI and Rust crates, there is always a danger that something is compromised somewhere. I try to limit attack surface in the following ways: - I only use M1 Macs as desktops. This reduces attack service in various ways. M1 Macs do not have anything like UEFI firmware, it all starts from the iBoot ROM and the whole chain is verified with signatures. The OS is on a sealed system Volume that is read-only and signed. Altogether, this limit firmware/OS attacks. - I use a U2F key and/or the Secure Enclave of the Mac for credentials (SSH keys, 2FA). They are set up to require user confirmation. - When possible, I will install applications from the Mac App Store, since they are sandboxed by default. - I use separate work and private Macs. - I clean and factory restore my Macs every few months. - I use some tools like Knock Knock to see if there is anything suspicious. Compromise is obviously possible, but I try to push it into 'mostly state actor' territory, because I am not interesting to most state actors.