5 ms·
It used to be you could trust your software—even most closed source—because only bad guys wanted to exfiltrate data from your system. The simple advice of “neve
by abtinf 7y ago
It used to be you could trust your software—even most closed source—because only bad guys wanted to exfiltrate data from your system. The simple advice of “never run an unknown executable” was an effective security practice.
Now, the incentives of software vendors—even open source—have changed to include data exhilaration en masse. Off the top of my head:
* Games that scan and upload the file hierarchy of your system.
* Software sync packages that casually provide third parties for research (Dropbox).
* Keyloggers embedded in the default operating system (web search in windows start; Ubuntu web search; Siri web search.
* Pervasive practice of running untrusted code with JavaScript and the seemingly inexorable march of granting web pages greater system access. Copy something to your clipboard, open a web page, and it can grab it, along with so much more.
* The push toward ever greater “telemetry”.
* Automatic background file uploads, like Microsoft defender sample submission.
* Pervasive ingestion of our data by governments.
The greatest threat to our security has become the vendors and government—the very entities whose job it is to protect us.
- saagarjha 7y ago> Keyloggers embedded in the default operating system (web search in windows start; Ubuntu web search; Siri web search. How exactly are these keyloggers?
- tenebrisalietum 7y agoThey send each keypress in a search to a remote service who is able to log it.
- saagarjha 7y agoI mean, how else do you expect web searches to work?
- mr__y 7y agoI would expect them to send search the query if and when I search for something and send exactly nothing when I don't
- saagarjha 7y agoAren't you literally searching for something in this case?
- mcbits 7y agoYes, searching for a local file or program 100% of the time because I would never intentionally search for anything else from there. That's specifically for Windows Start. If Ubuntu or Siri "web searches" are clearly distinguished from OS searches, then of course I'd expect them to send data somewhere.
- lrem 7y agoWait, how do you know that does search per keypress? I've just tried in Windows, and it doesn't seem to do anything until I press enter when the loupe is selected.
- deleted 7y ago[deleted]
- amenod 7y agoI mostly agree, however: > Copy something to your clipboard, open a web page, and it can grab it, along with so much more. Afaik this is not true [0][1]. [0] http://kb.mozillazine.org/Granting_JavaScript_access_to_the_clipboard http://kb.mozillazine.org/Granting_JavaScript_access_to_the_... [1] https://developers.google.com/web/updates/2018/03/clipboardapi https://developers.google.com/web/updates/2018/03/clipboarda...