>Besides keeping patched and being vigilant, you can be proactive by disabling active content such as scripting and Adobe/Java as listed above, by using FireFox with the NoScript extension. It's always good to be retroactive too, by having good backups.

IMO a Linux VM running on Win Host is better - having a dedicated Boot USB-stick for separate machine is best.
Currently my old 17' laptop has those tasks: running ubuntu with browser and nothing else
a single core 2Gig machine is good enough although adblocker on some sites is more helpful than on current CPUs.
I once tried to have separate installs with adobe or scripting allowed, but nowadays think a fully enabled install which
can be scrapped and replaced by a fresh copy is best. Clearly YMMV depending on personal habits,
but for me it is better to highten the fence as Murphy corollary says it will hit you exactly when safety is out of date.

regards

thomas