Apologies if I implied you were ignorant, or at more risk than most people. Hearing that description, I'm willing to bet you're safer than most people who do ru

Apologies if I implied you were ignorant, or at more risk than most people. Hearing that description, I'm willing to bet you're safer than most people who do run antivirus and the newest OS versions. (And safer than me, for that matter.) As far as principle, though, I think there have been things which can't be solved by avoiding sketchy links and emails? Bemstour was a mix of two NSA-discovered 0-days, which spent a full year in the wild before it was patched or disclosed. (Admittedly, the only known deployments were highly targeted, so it's not exactly grounds for personal paranoia.) EternalBlue was spun into the widespread WannaCry after the Windows 7 patch was released, but before Windows 8. (Having spent a while on 8 instead of 8.1 while 8.1 was still broken, that hits close to home.) I don't follow Windows that closely anymore, but haven't there been a few other botnets initiated with unpatched vulnerabilities that didn't require browsing somewhere ugly?