261–270 of 388 posts
Earlier quoted context omitted.
How does that make them the worst?
Commercial companies in free countries may be greedy or unethical, but they are generally predictable and usually follow the letter of the law. A state controlled entity in authoritarian country is another story.
Earlier quoted context omitted.
Not true. Google collects your searches. They don't sell your searches, they sell whatever they infer from your searches (your compiled and quite vague profile and I know, because I interacted with their AdSense platform), because they'd be stupid to sell your actual searches, since that's their most valuable property. Does anybody else know your search history? Besides the NSA, whom I assume have access to all US-ho…
It often irks me when people say things like "Google sells all of your data to advertisers and you are the product!" Not because there are no potential issues to discuss around ad-funded free services and data aggregation, but more because it's like clickbait (in that it oversimplifies a complex issue for emotional effect and makes discussion of actual issues more difficult). Using algorithms to build a general profi…
> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. I apologize for present anecdote when data is needed but I manage a Windows network with 100+ users and on a daily basis, Kaspersky catches 5-10 emails from Outlook that have nasty attachments. It prevents my users from opening these innocuous looking but nasty Invoice-Jan-2017.docx files. Without a good AV there…
Earlier quoted context omitted.
> Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?
It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish whi…
Earlier quoted context omitted.
An extraordinary amount of Cryptolocker outbreaks were due to .docx files containing macros. Yes, it has a default behaviour of "prompt to execute macros", but it happily shows the advice in the malicious document to "please click yes at this prompt to get a free iPhone", at which point the majority of users click "yes".
I think Swift on Security posted a tweet about this a while ago, with a screenshot of completely banning all Office macros via group policy.
There is a lot to be said for the skepticism around "free" products.
How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. We have the technology to do this (Qubes does it now) but it's not going mainstream. I don't know why but I think this would be the end goal of computing. Completely segregate your work from your machine and only give it access to things that make sense. (Chrome does…
Earlier quoted context omitted.
Yes they do, the cracking scene ethos is all about technical one-upmanship and the thrill and glory of beating copy protection. Or at least it used to be. The really smart ones do it for their own enjoyment or ideological reasons.
Not really, back in the MS-DOS, Atari, Amiga, Acorn, Mac OS days you surely need to first scan every single floppy before putting on the computer. The cracking scene was equally full of virus. Only in the very early days, during the genesis of the demoscene, it was as you describe.
I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…
How does that work with chromes certificate pinning for google? Do they do some runtime modification (e.g. DLL-injection) to disable the check?
>The Chromium browser disables pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools (such as mitmproxy or Fiddler). The RFC 7469 standard recommends disabling pinning violation reports for "user-defined" root certificates, where it is "acceptable" for the browser to disable pin validation.