@TheHobbyist isn't it better to find the plugged USB flash drive by parsing the output of dmesg?

@Shdwdrgn on Linux, the firewall with zero custom rules always allowed everything. did that change in very recent kernels? if that's the case, I'd expect a lot of lost acces to remote servers

@Shdwdrgn @Cornflake_Dog false. a firewall can indeed have a default block everything policy, but this is still a configurable option