3 ms·
Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingl
by noduerme 2y ago
Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
- tjoff 2y agoThat is because most systems comes with a firewall on and fairly limited surface area in the form of exposed services. But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world.
- throw0101d 2y ago> But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world. Yes. And you can not-expose them via default deny firewall rule. My home printer had an IPv6 in a prefix assigned from my ISP, but it was not accessible to the Internet (it was actually ping6-able because my Asus allowed ICMPv6 by default, but I could not connect to its web interface, like I can internally). Neither could I SSH into my macOS desktop or laptop from the outside (but could between the two internally). And even if my globally addressable devices were globally reachable (which they were not), good luck scanning a /64.
- tjoff 2y agoI know. But this old NAT vs. firewall crap was pointless decades ago. Still is.