Why are library and hotel computers not permanently riddled with malware?

On whether it is safe to use one, the honest answer is assume it is compromised and behave accordingly, because you cannot tell the well-managed ones from the badly-managed ones by looking.

A hardware keylogger between the keyboard and the machine defeats every software control listed above and costs almost nothing. A machine that has not been reset since the last person used it looks identical to one that resets hourly.

So the practical rules:

• Do not type a password you care about. Not email, not banking, not anything reused.
• If you must sign in to something, use a one-time code and change the password afterwards from a device you trust.
• Log out and close the browser, and do not rely on private browsing to have removed anything.
• Treat anything you download or leave behind as public.

Browsing, reading, printing a boarding pass — fine. Anything involving a credential — assume it is now somebody else's.

Both, in different proportions depending on who runs the machine — and I say that as someone who managed a fleet of them.

The well-managed ones work because they are not persistent. The core technique is that nothing a user does survives:

• The machine boots from a known-good image, often over the network with no writable local disk at all.
• Changes are written to a temporary layer in memory or to a disk area that is discarded.
• A reboot — nightly, or between sessions — returns it exactly to the image.

Once that is in place, malware is not prevented, it is simply temporary. Something installs itself, works for an hour, and then ceases to exist. There is nothing to clean, no scanning to do, and the machine cannot degrade over time because it does not accumulate anything.

That is a fundamentally different security model from a personal computer, and it is much stronger for this use case.

The supporting controls that come with it, since resetting alone is not the whole story:

• Users run without administrative rights, so most installation attempts fail in the first place.
• Software restriction policies allow only approved applications to execute.
• Network isolation puts public machines on their own segment with no route to anything internal — this is the control that protects the organisation rather than the user.
• Application allowlisting on the proxy limits where the browser can go.
• Physical measures — locked cases, disabled ports on some deployments.

Worth noting how much of this protects the operator rather than the person sitting down. The library's concern is that the machine cannot be used as a foothold into their network. Your safety as a user is a secondary benefit of a design aimed at something else.

One tell that a machine is properly managed: reboot it and see what happens.

If it comes back to a pristine desktop with no trace of the previous session, browser history cleared, no leftover files, that is the reset model working and it is a good sign. If your files are still there, it is a general purpose computer that has been left in a public place, and the difference matters enormously.

Most places will not mind you rebooting a public machine, and it takes a minute.