4 ms·

> biggest vector for malware is not an insecure operating system but user negligency This is victim blaming. Windows have been teaching users to install from t

> biggest vector for malware is not an insecure operating system but user negligency This is victim blaming. Windows have been teaching users to install from third parties since 90's, added auto-run features to removable media, hid files extensions making it difficult to detect files that could do harm, took a decade to implement processes isolation, never added a good package manager and spent years making fun of FLOSS. Windows users may have a twisted view about security. I personally heard a few of them saying things like "linux is safe because nobody uses it" or "you MUST use an anti-virus". They may sound naive of negligent but in fact, they were carefully trained for decades to behave that way.

mschuster91 5y ago
You have exactly the same issue in Mac users, though. Yes, Apple has an app store and added confirmation prompts and certificate checks in executables for everyone else, but people still download random stuff and ignore all security warnings.
- marcodiego 5y ago
  The problems are nowhere near the same level. AFAIK MacOS users have to, at least, move a package to a certain folder for installing it. It is not something that happens by accident or just clicking yes. EDIT: For people enlightening me about the other ways to install or run binaries on MacOS: thanks for the info! I have really little experience with MacOS, but my GF uses a MacBook and I know it is not as easy to be used in deceptive ways as Windows is. So, considering the other ways to install or run apps on MacOS, to they run the app inside a sandbox? Do they need the user to type a password? Do they run with limited permissions? Do they need explicitly working around notarization to run?
  - qwytw 5y ago
    You don't actually need to install .app containers by moving them to the Applications folder you can run them from anywhere. In fact they are just basically folders with a binary file inside so it's basically the same as downloading an .exe on Windows and just launching them (of course on modern macOS they run in a sandbox and require explicit permission to access any files outside of it). Apps shipped in a .pkg do need to be installed, though. But from an user standpoint the process is almost identical to a Windows installer wizard.
  - mschuster91 5y ago
    > AFAIK MacOS users have to, at least, move a package to a certain folder for installing it. That's wrong. There are multiple ways to distribute/install/run arbitrary programs on a macOS machine: - Opening a .dmg disk image file and moving the application inside to /Applications will "install" the application - Opening a .dmg disk image file and directly running the application inside will immediately run it with the current user's permission - Extracting a .zip archive will yield the application's directory in wherever the zip file is, ready to execute by clicking on it - Clicking on a .pkg installer will install the program to the path the user chooses (usually /Applications) - Clicking on a .pkg installer will allow the installer (after a confirmation prompt) to run a "pre-installation" script - Zoom infamously uses that to ease the installation process (https://www.reddit.com/r/programming/comments/ft3ai3/zoom_uses_preinstallation_script_to_install/ https://www.reddit.com/r/programming/comments/ft3ai3/zoom_us...) The last option is particularly dangerous since users in the admin group usually have passwordless sudo configured, which means that running the pre-installation script in a .pkg gives that script root permissions!
    - easton 5y ago
      > users in the admin group usually have passwordless sudo configured I don’t think that’s true. It’s not on by default in macOS, and to turn it on you have to edit /etc/sudoers which isn’t commonly done on macOS (since sudo permissions can be managed via the checkbox in System Preferences).
samtheDamned 5y ago
> Windows have been teaching users to install from third parties since 90's in this instance ReactOS is more secure than windows from the era it's replicating thanks to it's software center
will4274 5y ago
> Windows have been teaching users to install from third parties ? Installing directly from the source instead of from an intermediary is good, not bad. Walled garden and 1P-only app stores are worse than the problems they fix. > added auto-run features to removable media Imagine computers just working. Who would want that. Seriously, Microsoft has a lot to be criticized for, but none of the things in your comment make the list.
- josefx 5y ago
  > ? Installing directly from the source instead of from an intermediary is good, not bad. How many users did actually install directly from the source and not from a highly visible third party download page that collected and repackaged many programs with some drive by downloads involving adware? I remember falling for that a few times in my youth and even sites like Sourceforge hosting the projects directly ended up hijacking installers for a time. > Imagine computers just working. Who would want that. The fix was to pop up a window and asking if you want it to run. Nothing broken about that. Auto running software on an OS where everyone is sys admin by default is not a good idea.
  - will4274 5y ago
    I don't see anything wrong with auto running a CD. I physically put it in the computer. And seriously, what security checks do you think a normal user is going to do between the pop-up appearing and clicking "run"? Edit: three responses, zero examples of checks an actual user would do. Two references to the Sony rootkit, which was resolved after intense press by Sony removing the rootkit unconditionally, not by giving the users a choice, because everybody knows users would have clicked yes.
    - projct 5y ago
      We had a big hullabaloo about this in 2005 when Sony put a rootkit on audio CDs. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
    - 5y ago

mschuster91 5y ago

You have exactly the same issue in Mac users, though. Yes, Apple has an app store and added confirmation prompts and certificate checks in executables for everyone else, but people still download random stuff and ignore all security warnings.

marcodiego 5y ago
The problems are nowhere near the same level. AFAIK MacOS users have to, at least, move a package to a certain folder for installing it. It is not something that happens by accident or just clicking yes. EDIT: For people enlightening me about the other ways to install or run binaries on MacOS: thanks for the info! I have really little experience with MacOS, but my GF uses a MacBook and I know it is not as easy to be used in deceptive ways as Windows is. So, considering the other ways to install or run apps on MacOS, to they run the app inside a sandbox? Do they need the user to type a password? Do they run with limited permissions? Do they need explicitly working around notarization to run?
- qwytw 5y ago
  You don't actually need to install .app containers by moving them to the Applications folder you can run them from anywhere. In fact they are just basically folders with a binary file inside so it's basically the same as downloading an .exe on Windows and just launching them (of course on modern macOS they run in a sandbox and require explicit permission to access any files outside of it). Apps shipped in a .pkg do need to be installed, though. But from an user standpoint the process is almost identical to a Windows installer wizard.
- mschuster91 5y ago
  > AFAIK MacOS users have to, at least, move a package to a certain folder for installing it. That's wrong. There are multiple ways to distribute/install/run arbitrary programs on a macOS machine: - Opening a .dmg disk image file and moving the application inside to /Applications will "install" the application - Opening a .dmg disk image file and directly running the application inside will immediately run it with the current user's permission - Extracting a .zip archive will yield the application's directory in wherever the zip file is, ready to execute by clicking on it - Clicking on a .pkg installer will install the program to the path the user chooses (usually /Applications) - Clicking on a .pkg installer will allow the installer (after a confirmation prompt) to run a "pre-installation" script - Zoom infamously uses that to ease the installation process (https://www.reddit.com/r/programming/comments/ft3ai3/zoom_uses_preinstallation_script_to_install/ https://www.reddit.com/r/programming/comments/ft3ai3/zoom_us...) The last option is particularly dangerous since users in the admin group usually have passwordless sudo configured, which means that running the pre-installation script in a .pkg gives that script root permissions!
  - easton 5y ago
    > users in the admin group usually have passwordless sudo configured I don’t think that’s true. It’s not on by default in macOS, and to turn it on you have to edit /etc/sudoers which isn’t commonly done on macOS (since sudo permissions can be managed via the checkbox in System Preferences).

samtheDamned 5y ago

> Windows have been teaching users to install from third parties since 90's in this instance ReactOS is more secure than windows from the era it's replicating thanks to it's software center

will4274 5y ago

> Windows have been teaching users to install from third parties ? Installing directly from the source instead of from an intermediary is good, not bad. Walled garden and 1P-only app stores are worse than the problems they fix. > added auto-run features to removable media Imagine computers just working. Who would want that. Seriously, Microsoft has a lot to be criticized for, but none of the things in your comment make the list.

josefx 5y ago
> ? Installing directly from the source instead of from an intermediary is good, not bad. How many users did actually install directly from the source and not from a highly visible third party download page that collected and repackaged many programs with some drive by downloads involving adware? I remember falling for that a few times in my youth and even sites like Sourceforge hosting the projects directly ended up hijacking installers for a time. > Imagine computers just working. Who would want that. The fix was to pop up a window and asking if you want it to run. Nothing broken about that. Auto running software on an OS where everyone is sys admin by default is not a good idea.
- will4274 5y ago
  I don't see anything wrong with auto running a CD. I physically put it in the computer. And seriously, what security checks do you think a normal user is going to do between the pop-up appearing and clicking "run"? Edit: three responses, zero examples of checks an actual user would do. Two references to the Sony rootkit, which was resolved after intense press by Sony removing the rootkit unconditionally, not by giving the users a choice, because everybody knows users would have clicked yes.
  - projct 5y ago
    We had a big hullabaloo about this in 2005 when Sony put a rootkit on audio CDs. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
  - 5y ago