4 ms·

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations.

by ebg13 6y ago

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

lima 6y ago
What usually happens is that legitimate certificates are stolen.
- marcosdumay 6y ago
  What usually happens is that "legitimate" software distributors aren't. Just read the GP again. Second to that, it's that people set the information up so that they'll mislead your verification processes just enough to pass. Certificates stolen are way down from that.
haolez 6y ago
This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)
- jiggawatts 6y ago
  I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation. My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time. Huawei isn't doing anything different. The western governments just don't like it that they're copying them.
andrewxdiamond 6y ago
If you need a business address, it's pretty simple to get. The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange. https://www.microsoft.com/en-us/microsoft-365/business-insights-ideas/resources/how-to-get-a-business-mailing-address https://www.microsoft.com/en-us/microsoft-365/business-insig...
close04 6y ago
> malware outfits bringing in millions of dollars a year With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability. You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack. You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.
- ebg13 6y ago
  > With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place Exactly. That's why this should just stop. Because it hurts without helping.
  - close04 6y ago
    > That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. > it hurts without helping It helps me verify that the software I use comes from the developer I expected. It may not be a catch-all but I find value in this. Don't forget, your door lock can be opened in seconds and the person it inconveniences is mostly you, especially if you lock your keys inside. Your argument would be far more convincing if you took no precautions whatsoever because someone with millions to spend can bypass them.
    - ebg13 6y ago
      > It helps me verify that the software I use comes from the developer I expected. Nobody needs to charge money for me to be able to sign my executables with something like PGP. > The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.

by ebg13 6y ago

lima 6y ago

What usually happens is that legitimate certificates are stolen.

marcosdumay 6y ago
What usually happens is that "legitimate" software distributors aren't. Just read the GP again. Second to that, it's that people set the information up so that they'll mislead your verification processes just enough to pass. Certificates stolen are way down from that.

haolez 6y ago

This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)

jiggawatts 6y ago
I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation. My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time. Huawei isn't doing anything different. The western governments just don't like it that they're copying them.

andrewxdiamond 6y ago

If you need a business address, it's pretty simple to get. The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange. https://www.microsoft.com/en-us/microsoft-365/business-insights-ideas/resources/how-to-get-a-business-mailing-address https://www.microsoft.com/en-us/microsoft-365/business-insig...

close04 6y ago

> malware outfits bringing in millions of dollars a year With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability. You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack. You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.

ebg13 6y ago
> With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place Exactly. That's why this should just stop. Because it hurts without helping.
- close04 6y ago
  > That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. > it hurts without helping It helps me verify that the software I use comes from the developer I expected. It may not be a catch-all but I find value in this. Don't forget, your door lock can be opened in seconds and the person it inconveniences is mostly you, especially if you lock your keys inside. Your argument would be far more convincing if you took no precautions whatsoever because someone with millions to spend can bypass them.
  - ebg13 6y ago
    > It helps me verify that the software I use comes from the developer I expected. Nobody needs to charge money for me to be able to sign my executables with something like PGP. > The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.