Don't rely on the VPN kill switch for torrenting. It's not fast enough to prevent your IP from leaking if the VPN disconnects. The torrent client needs to be bound to the VPN interface. Transmission doesn't have an option to do that, so you would have to run it in a container instead.

Read comments

Look for high seed counts

Trust your gut

Trusted uploaders

Private torrent sites, some of them open to public periodically

I use and highly recommend Cleanuparr. Kills stalled torrents, and has a malware component to block known malware torrents.

I'm probably the most security paranoid person you may find here on Lemmy, I'm the kind of person who actually checks the gpg signatures of software I download, and refuses to use anything like AUR.

And I never worried one time in my life about exploits in media files, it's just extremely unlikely that between the time a 0day is discovered, and your system is updated (you do update frequently, right?), that torrent is going to exploit some player or media library.

Last time I heard of something like that, it was like 10 years ago, a gstreamer 0day that got quickly patched.

Executable files aren't going to execute themselves. If you don't chmod +x them they shouldn't execute at all even if you click them. I guess it can depend on your system.

I am much more concerned about internet facing applications like a web browser or torrent client.

If it's too good to be true, it's malware

If it isn't released yet, it is malware

If it is an .iso file but not a Linux distribution, it is malware

What infuriates me with malware, which idgaf because "arch btw", is that I reseed that shit unknowingly. Sometimes a lot.

Always check file before you let it seed forever as you should.

Your best bet is to join MAM. From there, you can progress to Aither and other sites within a reasonable amount of time through the invite forums.

If you dont already I would highly recommend private trackers.