Re: But
<= this should be your default.
Should also stop a lot of basic malware that runs from user locations. If you check out the NCSC "End user device (EUD) security guidance" for most platforms they recommend making user-writeable areas non-executable for exactly this sort of reason.
Biting the hand that feeds IT
