2 ms·

I wonder if I am doing too little in comparison? I just use incognito and adblock. My impression is that whenever there's a remote code execution bug in chrome

by zawerf 8y ago

I wonder if I am doing too little in comparison? I just use incognito and adblock. My impression is that whenever there's a remote code execution bug in chrome it becomes big news (ex: Meltdown/Spectre) so usually I can just trust the browser sandbox. Surely anyone with an exploit that can break the sandbox would use it on high value target rather than wasting it on the mass and having it get patched quickly? I think I've become complacent since it's been more than a decade since I've gotten a virus/malware just from clicking a link.

EpicEng 8y ago
>I think I've become complacent since it's been more than a decade since I've gotten a virus/malware just from clicking a link. The dangerous ones are precisely the ones you don't know about.
ItsMe000001 8y ago
> it's been more than a decade since I've gotten a virus/malware just from clicking a link I'm worried that I probably would not even know when/if I have any malware unless the malware detection actually manages to detect it. I think lots of malware tries to remain inconspicuous and not draw attention to itself, only using your machine as a gateway or data source. Even though I know TCP/IP inside out and could inspect my network traffic, there is soooo much stuff going on in today's PCs that I have no intention of even trying. I would not even know where to start if I had to inspect my operating system. I remember many years ago when a friend's laptop was always buys and created lots of network activity, it was obvious and easily confirmed that it had become a source of spam emails. I think a lot of malicious code is quite a bit more sophisticated and careful now, plus, the much increased bandwidth and raw PC power most people have available lets the same activity go unnoticed that 10 years ago might have had noticeable effects. That means I think that not noticing any malware nowadays is not proof of absence of malware when the base rate is included, i.e. if we assume a low number of infections assuming no malware gets it mostly right only because of the that, not because we have a reliable way to detect it. If the base rate changes and our assumptions about infections don't change that would be a sign that our own ability to detect infection does not play a role in how we get to our assumption. It would be an interesting study to compare measured infection rates with how safe users felt (if it is the same user population for both). AV vendors and Microsoft might be able to do that.

by zawerf 8y ago

EpicEng 8y ago

>I think I've become complacent since it's been more than a decade since I've gotten a virus/malware just from clicking a link. The dangerous ones are precisely the ones you don't know about.

ItsMe000001 8y ago

> it's been more than a decade since I've gotten a virus/malware just from clicking a link I'm worried that I probably would not even know when/if I have any malware unless the malware detection actually manages to detect it. I think lots of malware tries to remain inconspicuous and not draw attention to itself, only using your machine as a gateway or data source. Even though I know TCP/IP inside out and could inspect my network traffic, there is soooo much stuff going on in today's PCs that I have no intention of even trying. I would not even know where to start if I had to inspect my operating system. I remember many years ago when a friend's laptop was always buys and created lots of network activity, it was obvious and easily confirmed that it had become a source of spam emails. I think a lot of malicious code is quite a bit more sophisticated and careful now, plus, the much increased bandwidth and raw PC power most people have available lets the same activity go unnoticed that 10 years ago might have had noticeable effects. That means I think that not noticing any malware nowadays is not proof of absence of malware when the base rate is included, i.e. if we assume a low number of infections assuming no malware gets it mostly right only because of the that, not because we have a reliable way to detect it. If the base rate changes and our assumptions about infections don't change that would be a sign that our own ability to detect infection does not play a role in how we get to our assumption. It would be an interesting study to compare measured infection rates with how safe users felt (if it is the same user population for both). AV vendors and Microsoft might be able to do that.