4 ms·

I'm using PCs as an example precisely because they're not absolutely secure, yet despite this, everything is going fine, because the vectors of attack are so es

by tavavex 8mo ago

I'm using PCs as an example precisely because they're not absolutely secure, yet despite this, everything is going fine, because the vectors of attack are so esoteric. Tell me, when's the last time you've heard of an attack like what you described? Would you say that these attacks are equal in scale and threat to the countless times when millions of people were endangered through a botched OS security update, sandbox escape exploits, and other normal ways of doing malware? Is this a scalable attack that actually happens day-to-day? Is this something you worry about as much as securing your PC from normal exploits from the internet? And your example is ignoring two things that make it even more absurd. One, I've never seen a computer that will auto-boot into removable media, the default is always existing media first, and changing that requires user input. But also, if you have direct physical access to the PC, you don't need these complex basically-nonexistent boot exploits. If you have physical access, it's already over. You can invisibly MitM the network, monitor, keyboard/mouse inputs even if the device doesn't allow custom systems. You can wait for the system to be logged in, then take any data you need. If you're a government actor, you may even have devices that extract unencrypted data from almost anything using zero-days, even the most 'secure' computers or phones.

charcircuit 8mo ago
>everything is going fine Stealer malware is running rampant on the PC platform. It is not going fine. >One, I've never seen a computer that will auto-boot into removable media Look into late 20th century PCs. They are designed to boot from a floppy disk first. >But also, if you have direct physical access to the PC It does not take physical access to write to a floppy disk.
- tavavex 8mo ago
  > Stealer malware is running rampant on the PC platform. It exists. Arbitrary words like "rampant" let you skew the conversation in your favor with no data. In what I see, malware has only gotten rarer, and most people are never affected by anything like it. And then 99% of stealers get there by asking the user for permissions at the system level or using sandbox escape exploits, even in fully secure systems. > Look into late 20th century PCs. They are designed to boot from a floppy disk first. Yes. Luckily, we wised up and this is no longer the case. And we even managed to do it without locking users into what <VENDOR> has decided was the best and only choice for them! In addition to already being fixed, it's just completely irrelevant today. When have you last seen a PC with a floppy drive, let alone one that people continue feeding floppies to this day? Are you saying that you consider people writing modern floppy boot malware and then injecting those floppies into organizations running legacy computers an actual, realistic threat? > It does not take physical access to write to a floppy disk. It takes physical access to insert it, and a whole lot of indirect IRL access to sneak infected media into whatever business is still using them. I'm not saying these things aren't bad. I maintain my previous point - the 'drawbacks' of open computing are minuscule, but real. The fact that you had to go all the way back to floppies, boot malware and physical attacks proves the point of how esoteric it all is. The internet is the real killer, and it affects every platform. The counterexamples come off as the kind of improbable justifications that every software megacorporation breaks out every time they want to lock down something "for your safety".

by tavavex 8mo ago

charcircuit 8mo ago

>everything is going fine Stealer malware is running rampant on the PC platform. It is not going fine. >One, I've never seen a computer that will auto-boot into removable media Look into late 20th century PCs. They are designed to boot from a floppy disk first. >But also, if you have direct physical access to the PC It does not take physical access to write to a floppy disk.

tavavex 8mo ago
> Stealer malware is running rampant on the PC platform. It exists. Arbitrary words like "rampant" let you skew the conversation in your favor with no data. In what I see, malware has only gotten rarer, and most people are never affected by anything like it. And then 99% of stealers get there by asking the user for permissions at the system level or using sandbox escape exploits, even in fully secure systems. > Look into late 20th century PCs. They are designed to boot from a floppy disk first. Yes. Luckily, we wised up and this is no longer the case. And we even managed to do it without locking users into what <VENDOR> has decided was the best and only choice for them! In addition to already being fixed, it's just completely irrelevant today. When have you last seen a PC with a floppy drive, let alone one that people continue feeding floppies to this day? Are you saying that you consider people writing modern floppy boot malware and then injecting those floppies into organizations running legacy computers an actual, realistic threat? > It does not take physical access to write to a floppy disk. It takes physical access to insert it, and a whole lot of indirect IRL access to sneak infected media into whatever business is still using them. I'm not saying these things aren't bad. I maintain my previous point - the 'drawbacks' of open computing are minuscule, but real. The fact that you had to go all the way back to floppies, boot malware and physical attacks proves the point of how esoteric it all is. The internet is the real killer, and it affects every platform. The counterexamples come off as the kind of improbable justifications that every software megacorporation breaks out every time they want to lock down something "for your safety".