7 ms·

“But what about security? Are you sure you want to stay on an older version of Mac OS? — Thankfully I’m tech-savvy enough to know what I’m doing. The two Macs I

“But what about security? Are you sure you want to stay on an older version of Mac OS? — Thankfully I’m tech-savvy enough to know what I’m doing. The two Macs I use most are still on High Sierra and Mojave, and haven’t received security updates in quite a while. I haven’t had any security-related problem whatsoever.” How do people keep thinking nonsense like this, and then repeating it online to endanger other non-technical folks who also don’t know better? Author has no idea if he has had any security problems, because most malware isn’t about to alert you to it’s presence. You don’t run out-of-support software on an internet-connected computer.

hinoki 4y ago
https://nvd.nist.gov/vuln/detail/CVE-2018-4192 https://nvd.nist.gov/vuln/detail/CVE-2018-4192 https://nvd.nist.gov/vuln/detail/CVE-2019-8601 https://nvd.nist.gov/vuln/detail/CVE-2019-8601 Remote execution vulnerabilities happen in JavaScriptCore. Tech-savvy won’t save you, all it takes is some malicious ad code or some hacked server providing malicious JS (or media files, etc. etc.)
- newaccount74 4y ago
  Are there any proof-of-concept exploits for these issues anywhere that people could try out for themselves? I think it would go a long way to convincing people if you could for example visit a website that eg. changes your desktop background when you visit it, to show how dangerous it is to run unpatched systems. There are so many documented vulnerabilities that only apply to certain scenarios, that people (myself included) just think, "Hey, that sounds very theoretical, I don't think it applies in my case"
  - saagarjha 4y ago
    They’re a bit of a pain to implement but it might be worth doing…?
    - newaccount74 4y ago
      I wonder if they are actually possible. Remote code execution in the javascript engine does sound dangerous, but then you also have to get past address space randomisation, and then you need another exploit to escape the sandbox...
      - saagarjha 4y ago
        Right, all of which get patched every update as well. In theory chaining them together is doable, it’s just effort.
  - sph 4y ago
    I've been asking every chance I get whether these security issues affecting unsupported operating systems are actually being exploited in the wild. Three times I've asked, yet so far, no one has shown any proof whatsoever. Add to that proof of Spectre and Meltdown drive-by exploitation in the wild, today. While I do not condone the use of an insecure version of the OS, herd immunity is an underrated factor. Unless you're targeted, malware developers don't spend too much time on 0.5% market share, just like web developers don't optimise for unknown browsers. Prove me wrong.
    - bagels 4y ago
      Well, it hasn't happened for quite a few years, but it was quite common years ago to get drive by ad malware on up to date systems even. It's the main reason I started turning off JavaScript, and later using ad blockers. I can't imagine it's impossible today.
      - cedilla 4y ago
        It's the prevention paradox all over again. With Sepctre mitigations rolling out in under a month to almost all PCs, of course there is less incentive to build an exploit. But we know how it was when 90% of PCs were unpatched XP boxes.
    - muricula 4y ago
      Wannacry used the exploit from EternalBlue to create one of the most famous ransomware worms in recent memory, and wasn't the only malware to leverage that one exploit: https://arstechnica.com/information-technology/2019/05/eternally-blue-baltimore-city-leaders-blame-nsa-for-ransomware-attack/ https://arstechnica.com/information-technology/2019/05/etern... https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Despite lots and lots of POCs, I haven't seen attackers use spectre in the wild yet. Maybe sophisticated actors are using it but they haven't been caught yet, or more likely they just use more traditional and reliable ways to get info leaks. But if traditional info leaks dwindle, they may turn to speculative execution attacks.
      - 4y ago
- forgotmypw17 4y ago
  Adblock is the most effective security application we have today.
connordoner 4y ago
Thank God someone else said it.
unsafecast 4y ago
I run out-of-support software on an internet-connected computer, and I'm aware of the risks. I'm just really careful and I acknowledge that I'm at risk every time I go online. I assume the author thinks the same way.
- highwaylights 4y ago
  “I acknowledge that I’m at risk every time I go online.. I assume the author thinks the same way.” Just from reading the article, it does not seem that the author thinks the same way at all.
- bowsamic 4y ago
  It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of
  - kilpikaarna 4y ago
    Hyperbole much? Do you really think the potential consequences of driving the car of your analogy are comparable to the potential consequences of using an out of support operating aystem on your laptop?
    - bowsamic 4y ago
      You have purposefully misinterpreted my analogy in a bad faith way. The point is not to compare the severity, but to compare the total invisibility of the danger. That's why it's an analogy and not totally equivalent, it is only comparable in some ways... I swear to God sometimes Hacker News is so tiring
      - prepend 4y ago
resonious 4y ago
Yikes, yeah. I wonder if this person is tech-savvy enough to check their machines for botnet nodes.
- pmoriarty 4y ago
  How does one do that?
  - boppo1 4y ago
    Probably wireshark + process manager.
  - prepend 4y ago
    I use littlesnitch and watch for any unknown outbound connections. I once had tripwire setup and would look for any system changes but it got to be too much work.
bowsamic 4y ago
There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe
- chaosbolt 4y ago
  Meh you probably are if you're like me, a nobody. Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game. Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks. Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else. And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks. >tech people who think if you do X then you're totally safe Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.
  - bowsamic 4y ago
    Do you seriously think most vulnerabilities are used only for famous targets? Whatever gives you the illusion of safety I guess
  - tiagod 4y ago
    There's plenty of examples of 0day drive-by attacks being deployed to general public targets through ad-networks.
    - paulcole 4y ago
      What’s one example?
m00dy 4y ago
Nothing is safe, Mr. tech-savvy
deleted 4y ago
[deleted]
vegai_ 4y ago
https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
ThePowerOfFuet 4y ago
> You don’t run out-of-support software on an internet-connected computer. The rail industry, alas, begs to differ.
- oftenwrong 4y ago
  What have you seen?
  - abudabi123 4y ago
    Search newspaper headlines dated within the last 10 or 5 years?
  - ThePowerOfFuet 4y ago
    Lots of Windows 2000/XP and horribly-outdated Linux. They were acceptable decisions made back in the days before railways started deciding to network all the things, which wasn't really foreseeable at the time... and railway stuff tends to last 20-40 years.
- pelagicAustral 4y ago
  Is this a dig at OS/2?
  - ThePowerOfFuet 4y ago
    No, because that's actually still supported: https://www.arcanoae.com/arcaos/ https://www.arcanoae.com/arcaos/ https://www.ecomstation.com https://www.ecomstation.com
deleted 4y ago
[deleted]
anton96 4y ago
I think people have different perspective or objective of security. I would tend to think the author would be mainly concerned about having his bank account data leaked and loosing money or having some online account hacked and loosing access to it. As your rightly said, the author might already run some malicious program without knowing but as it doesn't impact his life in any meaningful way, that is totally virtual to him and sort of not existing then.
prepend 4y ago
I don’t think it’s nonsense. It’s important to be conscious of security, but that doesn’t mean automatically upgrading to everything all the time. There’s no way, that I know of, to be completely secure so I’d rather be conscious than a false feeling of safety. I run Catalina 10.15.7 and I think I run it secure enough. Of course maybe I’m rooted and all sorts of bad stuff, but I don’t think so. Of course, maybe the most recent version has an unknown zero day (negative day?) and would also be rooted. I think it’s naive to have a blanket rule like never run out of support software because sometimes we must. I run old devices that aren’t patchable or supported because they still have use (YouTube/Netflix) and I use them in an appropriate way, I think. I won’t conduct banking, but if someone breaches my Netflix account, I don’t care much. If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others, but then I also don’t want to keep buying dumb terminals for things and companies don’t seem to be changing their support timelines. This isn’t even mentioning stuff that’s risky like continuing to run my smart lightbulbs even though Phillips stopped supporting them years ago. I believe in calm technology and I’m not going to keep replacing stuff just because it has a non-zero risk.
- comte7092 4y ago
  >If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others. “Letting your machines become part of a botnet is nbd” is quite the take.
  - prepend 4y ago
    That’s not it at all. I just don’t think there’s a great risk of my machines being part of a botnet. Past performance doesn’t guarantee future performance but so far I’m a few decades in and no botnets so far (knock on wood).

hinoki 4y ago

https://nvd.nist.gov/vuln/detail/CVE-2018-4192 https://nvd.nist.gov/vuln/detail/CVE-2018-4192 https://nvd.nist.gov/vuln/detail/CVE-2019-8601 https://nvd.nist.gov/vuln/detail/CVE-2019-8601 Remote execution vulnerabilities happen in JavaScriptCore. Tech-savvy won’t save you, all it takes is some malicious ad code or some hacked server providing malicious JS (or media files, etc. etc.)

newaccount74 4y ago
Are there any proof-of-concept exploits for these issues anywhere that people could try out for themselves? I think it would go a long way to convincing people if you could for example visit a website that eg. changes your desktop background when you visit it, to show how dangerous it is to run unpatched systems. There are so many documented vulnerabilities that only apply to certain scenarios, that people (myself included) just think, "Hey, that sounds very theoretical, I don't think it applies in my case"
- saagarjha 4y ago
  They’re a bit of a pain to implement but it might be worth doing…?
  - newaccount74 4y ago
    I wonder if they are actually possible. Remote code execution in the javascript engine does sound dangerous, but then you also have to get past address space randomisation, and then you need another exploit to escape the sandbox...
    - saagarjha 4y ago
      Right, all of which get patched every update as well. In theory chaining them together is doable, it’s just effort.
- sph 4y ago
  I've been asking every chance I get whether these security issues affecting unsupported operating systems are actually being exploited in the wild. Three times I've asked, yet so far, no one has shown any proof whatsoever. Add to that proof of Spectre and Meltdown drive-by exploitation in the wild, today. While I do not condone the use of an insecure version of the OS, herd immunity is an underrated factor. Unless you're targeted, malware developers don't spend too much time on 0.5% market share, just like web developers don't optimise for unknown browsers. Prove me wrong.
  - bagels 4y ago
    Well, it hasn't happened for quite a few years, but it was quite common years ago to get drive by ad malware on up to date systems even. It's the main reason I started turning off JavaScript, and later using ad blockers. I can't imagine it's impossible today.
    - cedilla 4y ago
      It's the prevention paradox all over again. With Sepctre mitigations rolling out in under a month to almost all PCs, of course there is less incentive to build an exploit. But we know how it was when 90% of PCs were unpatched XP boxes.
  - muricula 4y ago
    Wannacry used the exploit from EternalBlue to create one of the most famous ransomware worms in recent memory, and wasn't the only malware to leverage that one exploit: https://arstechnica.com/information-technology/2019/05/eternally-blue-baltimore-city-leaders-blame-nsa-for-ransomware-attack/ https://arstechnica.com/information-technology/2019/05/etern... https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Despite lots and lots of POCs, I haven't seen attackers use spectre in the wild yet. Maybe sophisticated actors are using it but they haven't been caught yet, or more likely they just use more traditional and reliable ways to get info leaks. But if traditional info leaks dwindle, they may turn to speculative execution attacks.
    - 4y ago
forgotmypw17 4y ago
Adblock is the most effective security application we have today.

connordoner 4y ago

Thank God someone else said it.

unsafecast 4y ago

I run out-of-support software on an internet-connected computer, and I'm aware of the risks. I'm just really careful and I acknowledge that I'm at risk every time I go online. I assume the author thinks the same way.

highwaylights 4y ago
“I acknowledge that I’m at risk every time I go online.. I assume the author thinks the same way.” Just from reading the article, it does not seem that the author thinks the same way at all.
bowsamic 4y ago
It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of
- kilpikaarna 4y ago
  Hyperbole much? Do you really think the potential consequences of driving the car of your analogy are comparable to the potential consequences of using an out of support operating aystem on your laptop?
  - bowsamic 4y ago
    You have purposefully misinterpreted my analogy in a bad faith way. The point is not to compare the severity, but to compare the total invisibility of the danger. That's why it's an analogy and not totally equivalent, it is only comparable in some ways... I swear to God sometimes Hacker News is so tiring
    - prepend 4y ago

resonious 4y ago

Yikes, yeah. I wonder if this person is tech-savvy enough to check their machines for botnet nodes.

pmoriarty 4y ago
How does one do that?
- boppo1 4y ago
  Probably wireshark + process manager.
- prepend 4y ago
  I use littlesnitch and watch for any unknown outbound connections. I once had tripwire setup and would look for any system changes but it got to be too much work.

bowsamic 4y ago

There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe

chaosbolt 4y ago
Meh you probably are if you're like me, a nobody. Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game. Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks. Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else. And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks. >tech people who think if you do X then you're totally safe Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.
- bowsamic 4y ago
  Do you seriously think most vulnerabilities are used only for famous targets? Whatever gives you the illusion of safety I guess
- tiagod 4y ago
  There's plenty of examples of 0day drive-by attacks being deployed to general public targets through ad-networks.
  - paulcole 4y ago
    What’s one example?

m00dy 4y ago

Nothing is safe, Mr. tech-savvy

deleted 4y ago

[deleted]

vegai_ 4y ago

https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

ThePowerOfFuet 4y ago

> You don’t run out-of-support software on an internet-connected computer. The rail industry, alas, begs to differ.

oftenwrong 4y ago
What have you seen?
- abudabi123 4y ago
  Search newspaper headlines dated within the last 10 or 5 years?
- ThePowerOfFuet 4y ago
  Lots of Windows 2000/XP and horribly-outdated Linux. They were acceptable decisions made back in the days before railways started deciding to network all the things, which wasn't really foreseeable at the time... and railway stuff tends to last 20-40 years.
pelagicAustral 4y ago
Is this a dig at OS/2?
- ThePowerOfFuet 4y ago
  No, because that's actually still supported: https://www.arcanoae.com/arcaos/ https://www.arcanoae.com/arcaos/ https://www.ecomstation.com https://www.ecomstation.com

deleted 4y ago

[deleted]

anton96 4y ago

I think people have different perspective or objective of security. I would tend to think the author would be mainly concerned about having his bank account data leaked and loosing money or having some online account hacked and loosing access to it. As your rightly said, the author might already run some malicious program without knowing but as it doesn't impact his life in any meaningful way, that is totally virtual to him and sort of not existing then.

prepend 4y ago

I don’t think it’s nonsense. It’s important to be conscious of security, but that doesn’t mean automatically upgrading to everything all the time. There’s no way, that I know of, to be completely secure so I’d rather be conscious than a false feeling of safety. I run Catalina 10.15.7 and I think I run it secure enough. Of course maybe I’m rooted and all sorts of bad stuff, but I don’t think so. Of course, maybe the most recent version has an unknown zero day (negative day?) and would also be rooted. I think it’s naive to have a blanket rule like never run out of support software because sometimes we must. I run old devices that aren’t patchable or supported because they still have use (YouTube/Netflix) and I use them in an appropriate way, I think. I won’t conduct banking, but if someone breaches my Netflix account, I don’t care much. If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others, but then I also don’t want to keep buying dumb terminals for things and companies don’t seem to be changing their support timelines. This isn’t even mentioning stuff that’s risky like continuing to run my smart lightbulbs even though Phillips stopped supporting them years ago. I believe in calm technology and I’m not going to keep replacing stuff just because it has a non-zero risk.

comte7092 4y ago
>If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others. “Letting your machines become part of a botnet is nbd” is quite the take.
- prepend 4y ago
  That’s not it at all. I just don’t think there’s a great risk of my machines being part of a botnet. Past performance doesn’t guarantee future performance but so far I’m a few decades in and no botnets so far (knock on wood).