As has already been said JavaScript, Flash and such are the biggest risk. Browser vendors have tried to mitigate the attacks, but last I heard, only Mozilla's m

As has already been said JavaScript, Flash and such are the biggest risk. Browser vendors have tried to mitigate the attacks, but last I heard, only Mozilla's mitigation was actually effective at preventing attacks. I'd also personally not feel comfortable using a Windows PC, given that running unchecked 3rd-party code is sort of required to do anything with it.