[Causality1]

I'd also like to add a simple thing a lot of us technical-minded folks don't think about that much, and that's making sure the parent's daily driver user account isn't an administrator. That shrinks the attack surface significantly.