The point is that UAC will (hopefully) prevent installing untrusted code in the first place, there by preventing those types of attacks. Unfortunately, you have to either trust that the user knows what programs are good, or go down the dark road that leads to things like an app store.

Yeah but ... in Linux at least you have to set +x yourself on the downloads. Which is basic sanity check.

In windows there are too many ways to get elevated. And only one level of elevation.

not as if users care about watching out before setting +x.

After all, there are tons of popular projects requesting users to run "curl http://... | sudo sh" and consider that a good idea, too.

Exactly. This is just a more elaborate form of Windows little pop-up-boxes asking you "are you sure you want to...."

I keep trying to teach my nephews that the default answer to that question is no... but of course, "yes" is the way you get anything done.

Normal users just set them without thinking twice about it.

Do you know one of the most asked questions in Mac OS X user forums from new users is how to disable root?