4 ms·

I really doubt that, but I can't easily argue with an anecdote, so sure. It happened, probably 15 years ago. Windows was famous for tons of installers bundling

I really doubt that, but I can't easily argue with an anecdote, so sure. It happened, probably 15 years ago. Windows was famous for tons of installers bundling toolbars, but that's never been an epidemic on Mac. These days, Macs will not install unsigned software by default, and you can lock that down to App Store only with a single setting change, so they're certainly not getting bundled malicious toolbars from installing software... since distributing malware is a quick way to get your developer signature revoked, and you're certainly not going to be installing toolbars from the App Store sandbox. That leaves manually installing malicious toolbars through the official extension store for whatever browser they use. All extension stores do their best to weed out malicious extensions these days, and it takes intentional effort to install extensions. It doesn't just happen while you're trying to do other things. Obviously, toolbars don't even exist on iPads, and software installers bundling random malware is obviously not a huge concern on Chromebooks. A MacBook was not at the front of my list, so I don't know why you chose to singularly attack that option. Maybe you thought it was the easiest target?

cm2187 8y ago
But I don't think "it just happens" on windows either (outside of OEM crapware, which granted is pure dirt). Most of the time it is unsophisticated users led to click and install things themselves. An application signature won't help.
- coder543 8y ago
  how would application signing not help? if the OS won't let the user install the malware, that's the end of the line. As I said in my original comment, I don't think Windows 10 is as fragile as earlier versions. A large part of this is the additional enforcement around application signing, even though it isn't as strong as what macOS does by default. In earlier versions of Windows, it absolutely did "just happen" from a non-technical user's point of view. Linux, macOS, and (to a slightly lesser extent) Windows 10 do not allow it to "just happen".
  - cookiecaper 8y ago
    >if the OS won't let the user install the malware, that's the end of the line. except there's no definitive, 100% foolproof way to identify something as malware v. not-malware. If you put a bunch of dialogs in front of something, the site will just include a for-dummies illustration of what to click to allow the install. This will especially be the case if doing so is a prerequisite for receiving the new emoji pack, or whatever else it is that the people have been promised on the other side of those clicks. We've been through this song and dance enough times that it's not a question of whether this will happen or whether users will fall for it. It's clear that it will and they will. Users do not read dialog boxes, they interpret them as noise and click through them. Operating systems can only protect the user from themselves up to a certain point, at least while retaining the ability to install third-party software. My mom's computer(s) have been running Linux for probably 10 years now. This has kept her reasonably safe (especially as contrasted with my dad, who insists on Windows), but one time I went over to find some PDF injector-thing installed as a Chrome extension. From her POV, this "just happened". While using a less-targeted platform helps a lot, online malfeasance is not a platform-specific problem. Pretending otherwise is kidding ourselves. Vigilance is always needed.

cm2187 8y ago

But I don't think "it just happens" on windows either (outside of OEM crapware, which granted is pure dirt). Most of the time it is unsophisticated users led to click and install things themselves. An application signature won't help.

coder543 8y ago
how would application signing not help? if the OS won't let the user install the malware, that's the end of the line. As I said in my original comment, I don't think Windows 10 is as fragile as earlier versions. A large part of this is the additional enforcement around application signing, even though it isn't as strong as what macOS does by default. In earlier versions of Windows, it absolutely did "just happen" from a non-technical user's point of view. Linux, macOS, and (to a slightly lesser extent) Windows 10 do not allow it to "just happen".
- cookiecaper 8y ago
  >if the OS won't let the user install the malware, that's the end of the line. except there's no definitive, 100% foolproof way to identify something as malware v. not-malware. If you put a bunch of dialogs in front of something, the site will just include a for-dummies illustration of what to click to allow the install. This will especially be the case if doing so is a prerequisite for receiving the new emoji pack, or whatever else it is that the people have been promised on the other side of those clicks. We've been through this song and dance enough times that it's not a question of whether this will happen or whether users will fall for it. It's clear that it will and they will. Users do not read dialog boxes, they interpret them as noise and click through them. Operating systems can only protect the user from themselves up to a certain point, at least while retaining the ability to install third-party software. My mom's computer(s) have been running Linux for probably 10 years now. This has kept her reasonably safe (especially as contrasted with my dad, who insists on Windows), but one time I went over to find some PDF injector-thing installed as a Chrome extension. From her POV, this "just happened". While using a less-targeted platform helps a lot, online malfeasance is not a platform-specific problem. Pretending otherwise is kidding ourselves. Vigilance is always needed.