3 ms·
"Untrusted websites". Which websites do you trust, exactly? Malware has been distributed on many major websites most people would consider "trusted", either vi
by nknight 15y ago
"Untrusted websites". Which websites do you trust, exactly?
Malware has been distributed on many major websites most people would consider "trusted", either via ad networks or through simply cracking the servers.
On the Internet, you can't "trust" anybody not to be a vector for malware onto your client. Your client must be able to protect itself.
- bad_user 15y agoBy that rationale you shouldn't trust anybody from your social circle either, friends or otherwise. The world is an ugly place, full of bad people. That doesn't mean I need to barricade inside the house and give Apple the key. Which websites do you trust, exactly? The Ubuntu repository. Plus, I trust several publishers as good sources for packages that don't exist in Ubuntu's repository. On Windows - I either buy my software, or I'm getting known open-source software from their respective websites. I can't remember the last time my anti-virus (commercial, kept up to date) detected anything.
- nknight 15y agoAre you being deliberately obtuse? I honestly can't tell. First of all, I don't trust anyone from my social circle not to be a vector for malware on the Internet, just as I don't trust them to not be a vector for real-life viruses and bacteria. If they have been compromised, they can be an unwilling vector. Toward that end, I have an immune system, as well as additional strategies such as vaccinations, hand washing, good nutrition, etc., to help protect myself. Websites that have been compromised can be a vector for malware. Even HN could be a vector for malware. You can't simply trust that it isn't. Second, your "answer" has nothing to do with my question. I asked which websites you trust, not which software repositories you trust. Browsers can and have had flaws that permit malware installation and other arbitrary code execution without an affirmative action on your part. So I say again, more forcefully, which websites do you trust so completely that you believe they can never be a vector for malware?
- Tobu 15y agoMaybe the grandparent was stupid to mention "untrusted" websites. When you visit hundreds of websites per day, but stick to one browser, it's obvious that the responsibility for not breaking client security lies in the browser (and its platform), not the websites.
- trotsky 15y agoJust as an FYI, pretty much nobodies AV detects anything of note anymore. How malware campaigns are run these days are heavily reliant on rebuilt executables pre-tested against AV engines. AV is more or less completely broken (even more than it used to be) it's just there isn't particularly an alternative so it doesn't get discussed too much.