3 ms·
Well, you've either been very good or very lucky. But today most malware seems self-inflicted, and only spreads through naivety, ignorance and laziness. I ass
by ansible 14y ago
Well, you've either been very good or very lucky.
But today most malware seems self-inflicted, and only spreads through naivety, ignorance and laziness.
I assert that stereotypical "stupid users" were indeed the cause of most virus spreading in the 1980's and 1990's. There is still a fair amount of "stupid user" stuff happening these days, such as clicking on a link in an email to log into your bank account. (1)
However, these days, I'm also worried about exploits against browsers. If you have your system infected by just by visting a webpage, I don't consider that the user's fault.
Every year that goes by, the browser gets more complex (like recent support for 3-D rendering), and the attack surface increases. I'm glad that most browsers are fairly secure, but they're not perfect now, nor are they likely to be in the near future.
(1) It continues to annoy me that two of my banks will send out legitimate emails (new bill, etc.) that have clickable links in them. If the banks would stop putting links in their emails, and try to educate their users to not click on links in emails, that would reduce the problem.
- e40 14y agoIt continues to annoy me that two of my banks will send out legitimate emails (new bill, etc.) that have clickable links in them. This a million times. It never ceases to amaze me when I see this. It shows even the banks don't understand security!
- deleted 14y ago[deleted]
- ceras 14y agoDo you mind explaining what the problem is? Are you speaking against links in any emails, or just those with sensitive information? Why?
- bunderbunder 14y agoHowever, these days, I'm also worried about exploits against browsers. If you have your system infected by just by visting a webpage, I don't consider that the user's fault. I'm starting to consider a lot of these exploits and security problems to be the developer's fault. Too many attack vectors are well-known, and should be accounted for in the design of software. For example, overflow exploits: Why, in this day and age, do we still default to writing software that works with untrusted data in languages that don't enforce bounds checking? C++ has many virtues in many situations, but it's not a language for writing web browsers. For performance-critical modules that are small enough to make serious code auditing feasible, sure. But as the primary implementation language it's just one big vector for attack that pervades the entire codebase.