The single largest outstanding security problem with Windows is the one-two punch combo of hiding file extensions by default + not having an executable bit. This makes it insanely easy for an attacker to simply create a malicious executable that has the icon of a word document or other recognizable type. There is literally no way for a lay person to detect the danger there.

If there were an executable bit, exe’s from strange places wouldn’t just run without being granted permission. If extensions were visible by default, the very slightly savvy could SEE the danger. The combo lack-thereof is the danger.

With how many notifications Windows gives you already, it really seems like at the very least just warning you when you double click something the first time “this is an executable, use caution” would go a long way.

Binaries downloaded from browsers get stapled with a “potentially unsafe” extended attribute that pops a warning the first time you try to open it. This helps but is backwards. It should go the other direction and every binary should warn you until stapled with a “user has acknowledged the danger” attribute.