[danielweber]

Who is your threat? Are you worried about a spray-and-pray attacker who just dumps a bunch of malware out there? Or are you worried about being specifically targeted by someone who wants your stuff?

In the first case, a USB key bought at a big box store might be full of malware. In the second case, the big box store is the perfect place to buy something, as long as it's not the store where you always buy stuff, because the APT wants to keep his profile small.