Replies

You said: it’s not easy finding an app-whitelisting solution for home PCs

Software Restriction Policies are built in to all Windows versions (with the exception of Home, I believe).
The NSA even has a document showing exactly how to set this up: https://www.nsa.gov/ia/_files/os/win2k/application_whitelisting_using_srp.pdf
It works extremely well, but takes a bit of work to properly setup.
Google “using software restriction policies to whitelist” for more resources.

The basic theme is expressed in the last line of that document: Ensure that users cannot both write to and execute from any location.
This prevents malware from writing and executing. It may write itself to disk, but won’t be able to execute without privilege escalation.