OS X 10.8 comes with GateKeeper, which basically has three settings:
Allow only apps from Mac App Store
Allow only apps from Mac App Store or that are signed with a valid Apple Developer certificate
Allow any apps to be installed.
I typically recommend that all users leave it set to
1. unless they are installing a third party app that they trust. My thinking is that you're much less likely to be hit by a browser-based exploit that might download a malicious application onto your machine. Does this actually make a difference for things like browser-based exploits?
Obviously it was aimed at stopping installations of "fake" programs, but is it also a useful tool to reduce the surface area of something like a browser-based remote code execution exploit? Or is that sort of exploit immune to the protection that GateKeeper offers, since the browser itself is already trusted?