4 ms·

There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're to

There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe

chaosbolt 4y ago
Meh you probably are if you're like me, a nobody. Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game. Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks. Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else. And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks. >tech people who think if you do X then you're totally safe Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.
- bowsamic 4y ago
  Do you seriously think most vulnerabilities are used only for famous targets? Whatever gives you the illusion of safety I guess
- tiagod 4y ago
  There's plenty of examples of 0day drive-by attacks being deployed to general public targets through ad-networks.
  - paulcole 4y ago
    What’s one example?
    - marcinzm 4y ago
      The first Google result is: https://www.webtitan.com/blog/massive-malvertising-campaign-uses-zero-day-exploit-to-deliver-malware/ https://www.webtitan.com/blog/massive-malvertising-campaign-...
      - newaccount74 4y ago
        > the zero-day vulnerability has allowed the group to break out of the iframes and display malicious code to visitors and perform redirects That is of course something that shouldn't happen, but it's not a particularly severe threat.
- thfuran 4y ago
  So, botnets are a myth, I guess?
  - prepend 4y ago
    1.5 million people pay for AOL still [0]. It’s not that botnets are a myth, but there’s some users who actually do click on scams and let people remote into their machines. Just because botnets are real doesn’t invalidate GP’s points. [0] https://www.google.com/search?q=aol+number+of+customers&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari https://www.google.com/search?q=aol+number+of+customers&ie=U...
prepend 4y ago
> then you're totally safe I don’t know anyone who thinks they are totally safe. But I know a lot of tech savvy people who don’t run anti-virus or any countermeasures and think they are acceptably safe. I know it’s cliche to link to xkcd, but this comic seems relevant… https://xkcd.com/463/ https://xkcd.com/463/
- lgreiv 4y ago
  Of course there are pros and cons to this position, but just to state a con: anti-virus is usually running with elevated (if not maximum) permissions, tends to load basically any input and once in a while tries to be clever by using self-written interpreters or something along the lines of that. Using a native AV that does basic heuristic detection is fine and dandy and usually comes with a low performance penalty and requires few rights that other parts of the system do not already have. Using a non-root user for the daily grind and switching to elevated privileges only if required, running a PiHole (or a software adblocker) and monitoring outgoing traffic using Littlesnitch or LuLu likely comes at a better attack surface/performance/security trade-off, though, AFAIK.
  - prepend 4y ago
    I think the point is that on controlled images like voting machines you shouldn’t be installing anything at all this an anti-virus is unnecessary.
    - lgreiv 4y ago
      Ah, excuse me. I was not referring to the XKCD at all, I should have been clearer. Agreed, as usual „it depends“.
- enneff 4y ago
  Most of the countermeasures that are sold (such as AntiVirus software) are pretty much snake oil. The single easiest and most important thing you can do to keep your systems safe is to keep them updated.

There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe

chaosbolt 4y ago

Meh you probably are if you're like me, a nobody. Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game. Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks. Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else. And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks. >tech people who think if you do X then you're totally safe Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.

bowsamic 4y ago
Do you seriously think most vulnerabilities are used only for famous targets? Whatever gives you the illusion of safety I guess
tiagod 4y ago
There's plenty of examples of 0day drive-by attacks being deployed to general public targets through ad-networks.
- paulcole 4y ago
  What’s one example?
  - marcinzm 4y ago
    The first Google result is: https://www.webtitan.com/blog/massive-malvertising-campaign-uses-zero-day-exploit-to-deliver-malware/ https://www.webtitan.com/blog/massive-malvertising-campaign-...
    - newaccount74 4y ago
      > the zero-day vulnerability has allowed the group to break out of the iframes and display malicious code to visitors and perform redirects That is of course something that shouldn't happen, but it's not a particularly severe threat.
thfuran 4y ago
So, botnets are a myth, I guess?
- prepend 4y ago
  1.5 million people pay for AOL still [0]. It’s not that botnets are a myth, but there’s some users who actually do click on scams and let people remote into their machines. Just because botnets are real doesn’t invalidate GP’s points. [0] https://www.google.com/search?q=aol+number+of+customers&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari https://www.google.com/search?q=aol+number+of+customers&ie=U...

prepend 4y ago

> then you're totally safe I don’t know anyone who thinks they are totally safe. But I know a lot of tech savvy people who don’t run anti-virus or any countermeasures and think they are acceptably safe. I know it’s cliche to link to xkcd, but this comic seems relevant… https://xkcd.com/463/ https://xkcd.com/463/

lgreiv 4y ago
Of course there are pros and cons to this position, but just to state a con: anti-virus is usually running with elevated (if not maximum) permissions, tends to load basically any input and once in a while tries to be clever by using self-written interpreters or something along the lines of that. Using a native AV that does basic heuristic detection is fine and dandy and usually comes with a low performance penalty and requires few rights that other parts of the system do not already have. Using a non-root user for the daily grind and switching to elevated privileges only if required, running a PiHole (or a software adblocker) and monitoring outgoing traffic using Littlesnitch or LuLu likely comes at a better attack surface/performance/security trade-off, though, AFAIK.
- prepend 4y ago
  I think the point is that on controlled images like voting machines you shouldn’t be installing anything at all this an anti-virus is unnecessary.
  - lgreiv 4y ago
    Ah, excuse me. I was not referring to the XKCD at all, I should have been clearer. Agreed, as usual „it depends“.
enneff 4y ago
Most of the countermeasures that are sold (such as AntiVirus software) are pretty much snake oil. The single easiest and most important thing you can do to keep your systems safe is to keep them updated.