3 ms·

There is also the group of paranoid partially-technical people who consider a phone to be e-waste if it no longer receives software updates. I suggest to those

There is also the group of paranoid partially-technical people who consider a phone to be e-waste if it no longer receives software updates. I suggest to those people that they read the CVE list to see what they're _actually_ vulnerable to. Keep the browser updated, stop installing crapware, that thwarts the overwhelming majority of vulnerabilities. Zero-days can happen to absolutely any version; live in practicality, not fear.

ValdikSS 1y ago
Software exploits won't stab you with the knife: most probably you won't see any difference and have no idea that your phone is hacked. That's why for vulnerable/high-benefit target groups better be safe than sorry. However you're right, the whole industry is driven by fear, and basically no news agency write clear and concise vulnerability reports for the regular Joe.
- RadiozRadioz 1y ago
  > That's why for vulnerable/high-benefit target groups better be safe than sorry. Yes, but let's be practical. I'm not one of these people, in all likelihood you're not a high ranking member of government either. The attacks we are vulnerable to are wide-sweeping well-known vulnerabilities that are trivially exploitable, untargeted, in a browser or in user installed software. These exist, but we can learn about them and know if we are vulnerable, then make the judgment for if it's within our risk tolerance & risk appetite. Security is not an absolute. It must be informed by the real-world threat landscape, then modulated by individual risk on a case-by-case basis. Too many "security people" preach well-intentioned but incomplete advice.
  - ValdikSS 1y ago
    The officially registered company in my country sells feature phones with build-in trojans for years, and I can't make the government agencies do anything about that, or the shops to remove at least a known-trojaned models from the retail stock.
    - RadiozRadioz 1y ago
      That is a shame. Why must people be so terrible

ValdikSS 1y ago

Software exploits won't stab you with the knife: most probably you won't see any difference and have no idea that your phone is hacked. That's why for vulnerable/high-benefit target groups better be safe than sorry. However you're right, the whole industry is driven by fear, and basically no news agency write clear and concise vulnerability reports for the regular Joe.

RadiozRadioz 1y ago
> That's why for vulnerable/high-benefit target groups better be safe than sorry. Yes, but let's be practical. I'm not one of these people, in all likelihood you're not a high ranking member of government either. The attacks we are vulnerable to are wide-sweeping well-known vulnerabilities that are trivially exploitable, untargeted, in a browser or in user installed software. These exist, but we can learn about them and know if we are vulnerable, then make the judgment for if it's within our risk tolerance & risk appetite. Security is not an absolute. It must be informed by the real-world threat landscape, then modulated by individual risk on a case-by-case basis. Too many "security people" preach well-intentioned but incomplete advice.
- ValdikSS 1y ago
  The officially registered company in my country sells feature phones with build-in trojans for years, and I can't make the government agencies do anything about that, or the shops to remove at least a known-trojaned models from the retail stock.
  - RadiozRadioz 1y ago
    That is a shame. Why must people be so terrible