Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comparing how security experts and non-experts stay safe online

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: Comparing how security experts and non-experts stay safe online

#81

Post by tim333 »

modeless wrote: post #78
gruez wrote: post #59

Earlier quoted context omitted.

>Microsoft With windows 10 they're doing forced updates for home editions, so there's that.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

Even Chrome with it's "updating automatically and completely silently" needs restarting occasionally. It nagged me to do it just now.

Re: Comparing how security experts and non-experts stay safe online

#82

Post by modeless »

tim333 wrote: post #81
modeless wrote: post #78

Earlier quoted context omitted.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

Even Chrome with it's "updating automatically and completely silently" needs restarting occasionally. It nagged me to do it just now.

That's true; however Chrome restarts in a couple of seconds and restores most of your state. Also, all of the work of installing the update is done before it prompts you to do anything. None of that is true for Windows.

Re: Comparing how security experts and non-experts stay safe online

#83

Post by gruez »

modeless wrote: post #78
gruez wrote: post #59

Earlier quoted context omitted.

>Microsoft With windows 10 they're doing forced updates for home editions, so there's that.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

Actually, they have that functionality, at least in windows server 2003[1]. The 64 bit transition probably broke it.

https://support.microsoft.com/en-us/kb/897341

Re: Comparing how security experts and non-experts stay safe online

#84

Post by avn2109 »

sgc wrote: post #68
modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

As long as you aren't constantly bricking/breaking things, as has happened to me with updates from Windows 8 and Office.

It's not just MS, I'm pretty sure every Ubuntu OS update from Hardy to Lucid destroyed 1) my video configuration and 2) one other large thing and 3) 20 little things

Re: Comparing how security experts and non-experts stay safe online

#85

Post by innguest »

joosters wrote: post #76
lucb1e wrote: post #71

Earlier quoted context omitted.

Very good question, but I'm not sure how you imagine this could be addressed. Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an offi…

The paper acknowledges the problem in defining a security expert (see 5.1: Limitations) Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)

Traits of a security "expert":

- charges by the hour

- has no product to sell but hype and fear

- conflates "vulnerability" with "attackability" for profit

- thinks by breaking people's products they are helping fix them

- does not know the meaning of phrases such as "practical" and "real-world"

Security experts are snake oil peddlers.

They sell tougher doors so thieves can't knock them down, while the government furnishes thieves with universal jigglers/lockpickers.

The first security expert will be the person that stops the government from putting backdoors everywhere. They won't do that because to them, government backdoors are not a problem. Only your vulnerabilities, which do not prove a service can actually be attacked, are a problem in their eyes.

Which is why they charge you by the hour while working for the government implementing the backdoors that they use to scare you into paying them their high consultancy fees.

Re: Comparing how security experts and non-experts stay safe online

#86

Post by gruez »

modeless wrote: post #80
scholia wrote: post #79

Earlier quoted context omitted.

It's more reliable to install patches as part of a reboot because you know what's loaded and where it is. When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users. I expect Microsoft has lots of telemetry on this....

When you have 1.6 billion users, every time you waste 5 minutes of their time installing updates and rebooting, that wastes 190 human lifetimes worth of man-hours. I know that Microsoft does not properly account for this when deciding how much effort to allocate to making updates less intrusive.

Most people will not stare at the screen for 5 minutes while it's updating. They will be doing non-computer tasks in the meantime. Also, this ignores the ability for the updates to be postponed[1] until a convenient time (at lunch?, after work?), which means the lost productivity is reduced to the time it takes to restore the workspace.

[1] Even with windows 10's forced updates, I still think it's possible to postpone updates, just not indefinitely.

Re: Comparing how security experts and non-experts stay safe online

#87

Post by jacquesm »

medmunds wrote: post #42

Not entirely surprising the experts ranked "install software updates" #1, but it didn't even make the non-experts' top 5. We, as an industry, still have a long way to go in making it easy and safe for consumers to keep their software up to date. Have you ever tried to explain to someone (outside the industry) which "click to install the latest version" messages are important to obey, and which are malicious?

And which, even when they are not intended to be malicious will break your system in an unrecoverable way...

Re: Comparing how security experts and non-experts stay safe online

#88

Post by ytdht »

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

the problem with security updates is that they often include feature updates that are not security related... companies like Google appear to have too many engineers and implement changes that I would rather skip.

Re: Comparing how security experts and non-experts stay safe online

#89

Post by edison_carter »

lucb1e wrote: post #72
djent wrote: post #60

Earlier quoted context omitted.

What should I use as a VM environment/OS? Obviously I know GNU/Linux distros, but if all I'm going to be doing is using Firefox, I don't want a 8GB+ VM file hogging space on my normal system. Right now, I only have a 256 GB SSD in my laptop, and have my VMs on an external hard drive, which when plugged in to use uses up 1 out of my 2 USB ports. I would love to browse in a VM if I could get away without using a ton of…

I used to use Crunchbang whenever I wanted a lightweight, easy and modern GNU/Linux virtual machine, but they seem to have pulled the plug. Debian is what I'm most familiar with, so that's my new place to go. Still quite big with a relatively basic install, but not as big as Ubuntu or Linux Mint. Really lightweight stuff is Damn Small Linux (old) or Puppy Linux (never tried it), but I'm not sure how usable that is fo…

Crunchbang++ is a solid community effort to continue the late, lamented Crunchbang

https://crunchbangplusplus.org/

Re: Comparing how security experts and non-experts stay safe online

#90

Post by Florin_Andrei »

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

Exposing the whole update process to the end user is like exposing the innards of the car's engine to the driver. There's no need to do that. They don't need to be aware of it. It should be just part of the daily magic to them, the stuff that keeps things running even though they don't understand how it happens or are not even aware of it.

Of course, the intricacies of the process should still be exposed to the technical users via various tools and APIs.

Post reply on HN