> Your goal should be limiting exposure when it is compromised, not trying to lock down hatches on a leaky hull.

But isn't running applications only as regular users just that, limiting exposure?