Does the US have any extradition agreements with CA?

Fair point, but don’t make this a whattaboutism. Cheer them on for this

In my competitive industry I often have to install half baked software often written without security in mind and written by folks from all over the world that I’ve never met

Nothing gives white knuckles like piping a curl output to bash because your boss says to try out a program their friend found and you don’t have time to audit anything.

Though your point still holds. If you are careful you can do this with relative safety in Linux. Windows makes it harder tho

My antivirus for Linux is a policy of not executing things as root and installing things via safe channels when possible.

If I’m setting up a server or other untrusted service, I create a user specifically for it that has very limited permissions.

This makes it so that when something is compromised it is still trapped in a box and can’t spread.