3 ms·

That's bordering on complete paranoia. You can make this argument for any software you install with auto-update capabilities... which is likely significantly mo

That's bordering on complete paranoia. You can make this argument for any software you install with auto-update capabilities... which is likely significantly more than half the software the average person has. Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play.

kbenson 11y ago
If, like our phones, workstation software actually had to request specific access at install or use, then it would be much more dangerous if software that needed quite extensive access was exploited like this. But we don't. Our workstations are actually fairly dumb in this regard. Why is that? Note: Newer Windows an Mac systems might have this with their stores, I don't know. But a store isn't a requirement for this, so why have we had to wait so long?
qq66 11y ago
It's not paranoia to be deeply concerned by the security implications of a ton of auto updating software from dozens of vendors sitting on hundreds of millions of machines.
leni536 11y ago
>Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play. Well I'm not a security expert and I'm using Linux, so I don't use a Windows antivirus obviously. A quick test trying to download free or trial Windows antivirus software (I'm not willing to pay for this simple experiment): Kaspersky: - google Kaspersky - google result leads to http site, all the way to the download of the trial version it's http (I'm sure at least 80% of users don't notice this) - try to type in manually https://www.kaspersky.com - it redirects to http://www.kaspersky.com !!!! Ok let's try Avast, it's popular, isn't it? - ok it's all https, http redirects to https, it could even have HSTS, didn't check. - download links to http CNET site ... - I have to allow half the World's third party js to get to the download. - It's of course http, - Manually rewrite it to https (not straightforward, it's behind a redirection), invalid certificate (issued to a248.e.akamai.net instead of software-files-a.cnet.com - Its installer is probably loaded with CNET crapware anyway Downloading Avira worked fine though, I only tried these three. These companies are supposed to be security vendors, this is freaking ridiculous.
mikekchar 11y ago
Although I can understand what you are saying, and I would not put it at all like the OP did, I don't think it is necessarily paranoid. For example, almost every single piece of software on my laptop is open source and either built by me, or a 3rd party I trust that didn't write the software in the first place. The packages I install are even signed by that trusted 3rd party. This is one of the reasons why my laptop is more secure than a laptop where more than half of the software is auto-updated, obfuscated binaries built by the people who wrote the software. Certainly not everyone will do this. Although it is probably no longer considered part of the maniac fringe, I don't think it's going to be mainstream any time soon. However, the benefits are not imaginary.

kbenson 11y ago

If, like our phones, workstation software actually had to request specific access at install or use, then it would be much more dangerous if software that needed quite extensive access was exploited like this. But we don't. Our workstations are actually fairly dumb in this regard. Why is that? Note: Newer Windows an Mac systems might have this with their stores, I don't know. But a store isn't a requirement for this, so why have we had to wait so long?

qq66 11y ago

It's not paranoia to be deeply concerned by the security implications of a ton of auto updating software from dozens of vendors sitting on hundreds of millions of machines.

leni536 11y ago

>Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play. Well I'm not a security expert and I'm using Linux, so I don't use a Windows antivirus obviously. A quick test trying to download free or trial Windows antivirus software (I'm not willing to pay for this simple experiment): Kaspersky: - google Kaspersky - google result leads to http site, all the way to the download of the trial version it's http (I'm sure at least 80% of users don't notice this) - try to type in manually https://www.kaspersky.com - it redirects to http://www.kaspersky.com !!!! Ok let's try Avast, it's popular, isn't it? - ok it's all https, http redirects to https, it could even have HSTS, didn't check. - download links to http CNET site ... - I have to allow half the World's third party js to get to the download. - It's of course http, - Manually rewrite it to https (not straightforward, it's behind a redirection), invalid certificate (issued to a248.e.akamai.net instead of software-files-a.cnet.com - Its installer is probably loaded with CNET crapware anyway Downloading Avira worked fine though, I only tried these three. These companies are supposed to be security vendors, this is freaking ridiculous.

mikekchar 11y ago

Although I can understand what you are saying, and I would not put it at all like the OP did, I don't think it is necessarily paranoid. For example, almost every single piece of software on my laptop is open source and either built by me, or a 3rd party I trust that didn't write the software in the first place. The packages I install are even signed by that trusted 3rd party. This is one of the reasons why my laptop is more secure than a laptop where more than half of the software is auto-updated, obfuscated binaries built by the people who wrote the software. Certainly not everyone will do this. Although it is probably no longer considered part of the maniac fringe, I don't think it's going to be mainstream any time soon. However, the benefits are not imaginary.