It's amazing to me what people will put up with to avoid an attack vector that doesn't have a single known victim. I don't run untrusted programs or Javascript. I see no reason to install any of these measures on my personal desktop until people actually start being victimized by them.