A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.
I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.
Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.
Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be.
Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and some AMDs) with built-in Ethernet, just in case it doesn't like the Wi-Fi card. Install with kernel-latest (it's a simple option when you boot into the installer ISO), and try it out. Grab a T480/T480s if you have one handy, and you may be surprised.
I have a bunch of desktops and mini desktops I have laying around I can try it on. I'm assuming it works on most Linux hardware, except maybe the wifi? For example I have a few Beelink GK Minis and Geekom computers.
Generally speaking, if your Wi-Fi works on Debian and/or Fedora, it should work on Qubes OS. There are exceptions to that, of course.
On a desktop PC you'll have to make some tradeoffs versus most laptops, namely integrating sys-net and sys-usb, but the installer will handle that for you. You'll want to auto-accept your keyboard and mouse, and try not to shut down sys-net. But you'll learn. Since your concern is isolating software you're running, and not necessarily isolating untrusted USB devices, that's not a big loss.
Give it a shot on a few machines and report back. Even better, try it and submit HCL reports to inform others: https://www.qubes-os.org/hcl/ Intel is generally easier than AMD, but I've run it on pretty modern AMD mobile chipsets with a lot of success.
Again, kernel-latest is your friend, and look online to see if anyone recommends any particular kernel flags.
Small and cheap cloud VM, preferably on a separate account used for this purpose specifically.
A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.
https://dl.acm.org/doi/10.1145/358198.358210
Have you tried VirtualBox? That’s my go-to for running un-trusted code. Start with a clean VM/fresh install, and don’t put any secrets in it.
I think that might be the only way. That or maybe even this? https://github.com/89luca89/distrobox
I assume that if it's not air-gapped, it's compromised. I keep important stuff offline.
Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.
I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.
Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.
Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be.
Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and some AMDs) with built-in Ethernet, just in case it doesn't like the Wi-Fi card. Install with kernel-latest (it's a simple option when you boot into the installer ISO), and try it out. Grab a T480/T480s if you have one handy, and you may be surprised.
I have a bunch of desktops and mini desktops I have laying around I can try it on. I'm assuming it works on most Linux hardware, except maybe the wifi? For example I have a few Beelink GK Minis and Geekom computers.
Generally speaking, if your Wi-Fi works on Debian and/or Fedora, it should work on Qubes OS. There are exceptions to that, of course.
On a desktop PC you'll have to make some tradeoffs versus most laptops, namely integrating sys-net and sys-usb, but the installer will handle that for you. You'll want to auto-accept your keyboard and mouse, and try not to shut down sys-net. But you'll learn. Since your concern is isolating software you're running, and not necessarily isolating untrusted USB devices, that's not a big loss.
Give it a shot on a few machines and report back. Even better, try it and submit HCL reports to inform others: https://www.qubes-os.org/hcl/ Intel is generally easier than AMD, but I've run it on pretty modern AMD mobile chipsets with a lot of success.
Again, kernel-latest is your friend, and look online to see if anyone recommends any particular kernel flags.