4 ms·

That take seems naive. A lot of malware works by getting the full consent of the user. Users often have no idea what they’re consenting to or the implications

That take seems naive. A lot of malware works by getting the full consent of the user. Users often have no idea what they’re consenting to or the implications of it. And on top of that if you really require code to get permission for all resources they require customers will immediately look for ways to avoid having to manually do this step. The problem is that malware has basically an infinite number of tries to get you to run something. As there is almost no consequence when they fail.

dmichulke 2y ago
> That take seems naive. A lot of malware works by getting the full consent of the user. Users often have no idea what they’re consenting to or the implications of it. That's IMO quite the defeatist attitude. Is there any way around this? And if so, who can go that way? In my opinion it's only Microsoft that can unilaterally improve the situation, not the least by letting the user make those decisions in the first place and also have him live with the consequences (loss of time / money). They will learn, especially after experiencing pain due to a wrong decision. A nanny OS that decides by itself won't make the user learn and it will always have loopholes.
candiddevmike 2y ago
Microsoft has proven they can make an iron clad secure system: the Xbox. Everything runs as a micro VM. Why can't they apply this architecture to Windows?
- wrs 2y ago
  Consider the differences in customer and developer expectations of applications on Xbox vs. Windows.
ryukoposting 2y ago
> A lot of malware works by getting the full consent of the user. Consent of the user to do what? If a program can't even ask permission to walk the entire filesystem, zip it up and encrypt it, then it simply can't do that at all. The user never even becomes a factor. I'll reiterate that I'm not saying all malware goes away, but entire classes of malware would cease to exist. > if you really require code to get permission for all resources they require customers will immediately look for ways to avoid having to manually do this step. If you go in your pocket, you'll find a compelling case study to the contrary. For the most part, permission grants are a one-time thing for any given service. They don't even register as a mild nuisance. > The problem is that malware has basically an infinite number of tries to get you to run something. As there is almost no consequence when they fail. And what does AV software do to solve either of these problems?
- kenjackson 2y ago
  Android vs iPhone is a great example of things in your pocket and malware. Both effectively run AV at store ingestion so users don’t have to think about malware at all. But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. The only model that has worked in practice is the model where malware is checked upstream (eg during App Store ingestion) and users are never even offered it.
  - Ajedi32 2y ago
    "Flourish" is a bit of an exaggeration. You have to jump through a lot of hoops to install malware of any significant capability on Android, ignoring like a half dozen red flags in the process. Obviously that's not going to be enough to stop everybody, but compared to Windows Android is practically malware-free. But yes, in a corporate environment it might be prudent to have some kind of policy restricting users from installing applications from non-approved sources (or at least limiting what permissions such unapproved applications can have). Thankfully the permissions model of Android makes such restrictions trivial to enforce and minimally inconvenient compared to what you have to do to get an inferior version of the same thing on Windows.
    - paulmd 2y ago
      For years (most recently 2021) Nokia’s threat assessment reports have android malware infection rates at over 50x iOS. iOS malware exists but it’s largely state-level actors going after dissidents or journalists (and apple provides tools to help fight that too, if you think you’re that kind of target). Android is actually an outright majority of all malware in the wild... 50.31% of all malware infestions, which includes windows, OSX, IOT, and all other sources (ie ios). https://vpnoverview.com/wp-content/uploads/nokia_threat_intelligence_report_2021_report_en.pdf https://vpnoverview.com/wp-content/uploads/nokia_threat_inte... (see also page 17-19 which discusses key threats and mitigation strategies, particularly surrounding the play store and the android ecosystem.) Pretty sure stalkerware is openly carried in the play store, it definitely is carried in some of the seedier stores. If you have actual data that contradicts this, fire away, but every time it's objectively measured android comes out way way way worse on the malware front.
hulitu 2y ago
> Users often have no idea what they’re consenting to or the implications of it UAC didn't help, isn't it ? If Microsoft would concentrate a bit on GUIs and UXs maybe they would be able to fix it. /s

dmichulke 2y ago

> That take seems naive. A lot of malware works by getting the full consent of the user. Users often have no idea what they’re consenting to or the implications of it. That's IMO quite the defeatist attitude. Is there any way around this? And if so, who can go that way? In my opinion it's only Microsoft that can unilaterally improve the situation, not the least by letting the user make those decisions in the first place and also have him live with the consequences (loss of time / money). They will learn, especially after experiencing pain due to a wrong decision. A nanny OS that decides by itself won't make the user learn and it will always have loopholes.

candiddevmike 2y ago

Microsoft has proven they can make an iron clad secure system: the Xbox. Everything runs as a micro VM. Why can't they apply this architecture to Windows?

wrs 2y ago
Consider the differences in customer and developer expectations of applications on Xbox vs. Windows.

ryukoposting 2y ago

> A lot of malware works by getting the full consent of the user. Consent of the user to do what? If a program can't even ask permission to walk the entire filesystem, zip it up and encrypt it, then it simply can't do that at all. The user never even becomes a factor. I'll reiterate that I'm not saying all malware goes away, but entire classes of malware would cease to exist. > if you really require code to get permission for all resources they require customers will immediately look for ways to avoid having to manually do this step. If you go in your pocket, you'll find a compelling case study to the contrary. For the most part, permission grants are a one-time thing for any given service. They don't even register as a mild nuisance. > The problem is that malware has basically an infinite number of tries to get you to run something. As there is almost no consequence when they fail. And what does AV software do to solve either of these problems?

kenjackson 2y ago
Android vs iPhone is a great example of things in your pocket and malware. Both effectively run AV at store ingestion so users don’t have to think about malware at all. But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. The only model that has worked in practice is the model where malware is checked upstream (eg during App Store ingestion) and users are never even offered it.
- Ajedi32 2y ago
  "Flourish" is a bit of an exaggeration. You have to jump through a lot of hoops to install malware of any significant capability on Android, ignoring like a half dozen red flags in the process. Obviously that's not going to be enough to stop everybody, but compared to Windows Android is practically malware-free. But yes, in a corporate environment it might be prudent to have some kind of policy restricting users from installing applications from non-approved sources (or at least limiting what permissions such unapproved applications can have). Thankfully the permissions model of Android makes such restrictions trivial to enforce and minimally inconvenient compared to what you have to do to get an inferior version of the same thing on Windows.
  - paulmd 2y ago
    For years (most recently 2021) Nokia’s threat assessment reports have android malware infection rates at over 50x iOS. iOS malware exists but it’s largely state-level actors going after dissidents or journalists (and apple provides tools to help fight that too, if you think you’re that kind of target). Android is actually an outright majority of all malware in the wild... 50.31% of all malware infestions, which includes windows, OSX, IOT, and all other sources (ie ios). https://vpnoverview.com/wp-content/uploads/nokia_threat_intelligence_report_2021_report_en.pdf https://vpnoverview.com/wp-content/uploads/nokia_threat_inte... (see also page 17-19 which discusses key threats and mitigation strategies, particularly surrounding the play store and the android ecosystem.) Pretty sure stalkerware is openly carried in the play store, it definitely is carried in some of the seedier stores. If you have actual data that contradicts this, fire away, but every time it's objectively measured android comes out way way way worse on the malware front.

hulitu 2y ago

> Users often have no idea what they’re consenting to or the implications of it UAC didn't help, isn't it ? If Microsoft would concentrate a bit on GUIs and UXs maybe they would be able to fix it. /s