Or on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on.

It's turtles all the way down.

IMHO, the bigger concern is the exploits that the wider community hasn't found yet. How many nasty tricks were out there in Stuxnet for years before anybody noticed? Just given the scale of the stuff that's been found, I'm inclined to think that trying to out-secure organizations with that kind of resources is a losing battle.

You're better of not being somebody anyone would invest that kind of effort to hack. Or at least making your traffic not identifiable as somebody that your opponent would want to hack.

Last I checked, holders of large amounts of Bitcoin tend to avoid letting their identity be associated with their accounts easily, and that's probably why. I bet somebody would be willing to risk a few $100k exploits to get a few $million worth of BTC.

That's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box.

...

Unplugged from the mains.

Qubes tries to build the OS that way.

https://www.qubes-os.org/

> Starting to think that running apps within a container is the right way to go.

If you're talking about something like Linux containers, note that the Chrome Pwn2Own exploit involved a sandbox escape via a kernel exploit. (Though seccomp-BPF mitigates this to some extent on Linux.)

See Sandboxie