3 ms·
On the slightly less dark side, we can probably assume that this class of exploits is so valuable that nobody would use it against a large number of people at o
by ufmace 12y ago
On the slightly less dark side, we can probably assume that this class of exploits is so valuable that nobody would use it against a large number of people at once in an ordinary way, like sending out spam emails or comments with links to build a botnet. That would likely result in it getting noticed and patched quickly, for very little return on investment.
These types of exploits are probably only used by very well financed organizations in carefully targeted ways, so as to justify the huge cost of finding them and keep them unnoticed and unpatched for as long as possible. See the recent stories on the Equation group-associated malware. You and I are probably safe enough, but somebody like Edward Snowden better be very careful where he surfs.
- deleted 12y ago[deleted]
- tonyhb 12y agoI've never thought about surfing in a VM before, but it seems that if you're ultra paranoid that it would be best to do so. Starting to think that running apps within a container is the right way to go.
- pfraze 12y agoQubes tries to build the OS that way. https://www.qubes-os.org/ https://www.qubes-os.org/
- alex_anglin 12y agoOr on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on. It's turtles all the way down.
- gpmcadam 12y agoThat's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box. ... Unplugged from the mains.
- ufmace 12y agoIMHO, the bigger concern is the exploits that the wider community hasn't found yet. How many nasty tricks were out there in Stuxnet for years before anybody noticed? Just given the scale of the stuff that's been found, I'm inclined to think that trying to out-secure organizations with that kind of resources is a losing battle. You're better of not being somebody anyone would invest that kind of effort to hack. Or at least making your traffic not identifiable as somebody that your opponent would want to hack. Last I checked, holders of large amounts of Bitcoin tend to avoid letting their identity be associated with their accounts easily, and that's probably why. I bet somebody would be willing to risk a few $100k exploits to get a few $million worth of BTC.
- slantedview 12y agoSee Sandboxie
- pcwalton 12y ago> Starting to think that running apps within a container is the right way to go. If you're talking about something like Linux containers, note that the Chrome Pwn2Own exploit involved a sandbox escape via a kernel exploit. (Though seccomp-BPF mitigates this to some extent on Linux.)