4 ms·

Though I share your sentiments, that pattern worked very well at infecting machines with malware for 20 years because the average user is a bad judge of which s

Though I share your sentiments, that pattern worked very well at infecting machines with malware for 20 years because the average user is a bad judge of which sites to trust to install software on their device. Then again, app stores haven't solved the malware problem, and neither have solutions like trusted publishers / signing executables / etc. I look forward to seeing a solution that isn't worst-of-both-worlds.

spacemanmatt 6y ago
I don't know there's a great solution to secure general purpose computing. Malware has been part of my life since 5.25" floppy disk era.
throwaway316943 6y ago
I remember installing software before app stores. Everyone was always afraid of malware but very few people I knew ever suffered from it. Most people used anti virus software, asked their friends which programs they recommended, or did some research of their own to figure out what was safe to download. All that was probably at least as effective as the “curation” that app stores provide. The problem is that now a lot of people implicitly trust apps from app stores and there is the added harm that there are now sanctioned forms of malware that serve ads, steal info and try to sell you exploitative in app purchases.
- jcpham2 6y ago
  The problem is that code execution evolved to ransomware because cryptocurrency. If we’re being honest, some barriers were crossed and the threat evolved
  - alpaca128 6y ago
    > code execution evolved to ransomware because cryptocurrency Cryptocurrency might have made it easier, but such scams are older than that. Just look at the whole range of tech support scams based on voucher codes.
    - selfhoster11 6y ago
      A tech support scam can be unlocked by a competent technician for much less than the amount requested by the crooks. A ransomware attack with asymmetric crypto cannot be unlocked in a similar way, math simply won't let you (bar faulty ransomware that happens to reveal its key).
- lotsofpulp 6y ago
  > Everyone was always afraid of malware but very few people I knew ever suffered from it. Most people used anti virus software, asked their friends which programs they recommended, or did some research of their own to figure out what was safe to download. All that was probably at least as effective as the “curation” that app stores provide. That’s the opposite of my experience. I remember lots of malware - toolbars, search engine defaults, using malware bytes, ccleaner, antivirus programs, and a bunch of other crap I can’t remember to de-malware my older relatives’ computers when I was a kid. There was no way to prevent my elders from getting malware on their Windows computers, because they just had to click on everything. Then iOS came out and I never spent another minute dealing with uninstalling and scanning for malware. Any software problems were solved by deleting the app, or turning the device off and on.
thu2111 6y ago
What fixed that is sandboxing. It's not really clear how much app stores do. And in fairness to Google, their malware scanning system is not tied to their app store. Stuff installed outside the store gets scanned too.
alpaca128 6y ago
> I look forward to seeing a solution that isn't worst-of-both-worlds Software repositories? Still not perfect in terms of security but better than manually searching for installer packages, deciding between the official download that requires some account registration or a slightly questionable download site and then hoping for the best. Same for updates - the way many third-party programs on Windows expect me to basically download and reinstall the whole program again unless the developer built their own custom auto-updater is ridiculous. And for the average user I'd say technologies between flatpak and Snap are a decent step in the right direction - easier installation and updates, less trouble with dependencies(in theory), a bit of isolation and file access limits. Unless you want to explain relatives how to setup Qubes OS this is probably the next best thing within the near future.
bambax 6y ago
> Though I share your sentiments, that pattern worked very well at infecting machines with malware for 20 years And what happened? Did we all die? It's not just the security promise that's unfulfilled, it is also the threats that are way overblown.

spacemanmatt 6y ago

I don't know there's a great solution to secure general purpose computing. Malware has been part of my life since 5.25" floppy disk era.

throwaway316943 6y ago

I remember installing software before app stores. Everyone was always afraid of malware but very few people I knew ever suffered from it. Most people used anti virus software, asked their friends which programs they recommended, or did some research of their own to figure out what was safe to download. All that was probably at least as effective as the “curation” that app stores provide. The problem is that now a lot of people implicitly trust apps from app stores and there is the added harm that there are now sanctioned forms of malware that serve ads, steal info and try to sell you exploitative in app purchases.

jcpham2 6y ago
The problem is that code execution evolved to ransomware because cryptocurrency. If we’re being honest, some barriers were crossed and the threat evolved
- alpaca128 6y ago
  > code execution evolved to ransomware because cryptocurrency Cryptocurrency might have made it easier, but such scams are older than that. Just look at the whole range of tech support scams based on voucher codes.
  - selfhoster11 6y ago
    A tech support scam can be unlocked by a competent technician for much less than the amount requested by the crooks. A ransomware attack with asymmetric crypto cannot be unlocked in a similar way, math simply won't let you (bar faulty ransomware that happens to reveal its key).
lotsofpulp 6y ago
> Everyone was always afraid of malware but very few people I knew ever suffered from it. Most people used anti virus software, asked their friends which programs they recommended, or did some research of their own to figure out what was safe to download. All that was probably at least as effective as the “curation” that app stores provide. That’s the opposite of my experience. I remember lots of malware - toolbars, search engine defaults, using malware bytes, ccleaner, antivirus programs, and a bunch of other crap I can’t remember to de-malware my older relatives’ computers when I was a kid. There was no way to prevent my elders from getting malware on their Windows computers, because they just had to click on everything. Then iOS came out and I never spent another minute dealing with uninstalling and scanning for malware. Any software problems were solved by deleting the app, or turning the device off and on.

thu2111 6y ago

What fixed that is sandboxing. It's not really clear how much app stores do. And in fairness to Google, their malware scanning system is not tied to their app store. Stuff installed outside the store gets scanned too.

alpaca128 6y ago

> I look forward to seeing a solution that isn't worst-of-both-worlds Software repositories? Still not perfect in terms of security but better than manually searching for installer packages, deciding between the official download that requires some account registration or a slightly questionable download site and then hoping for the best. Same for updates - the way many third-party programs on Windows expect me to basically download and reinstall the whole program again unless the developer built their own custom auto-updater is ridiculous. And for the average user I'd say technologies between flatpak and Snap are a decent step in the right direction - easier installation and updates, less trouble with dependencies(in theory), a bit of isolation and file access limits. Unless you want to explain relatives how to setup Qubes OS this is probably the next best thing within the near future.

bambax 6y ago

> Though I share your sentiments, that pattern worked very well at infecting machines with malware for 20 years And what happened? Did we all die? It's not just the security promise that's unfulfilled, it is also the threats that are way overblown.