Karmastic
Posts: 1650
Joined: 4/5/2012 From: Los Angeles Status: offline
|
quote:
ORIGINAL: RedMagic1 quote:
ORIGINAL: Karmastic you said you were "disturbed" that i was "providing incorrect security advice" to your real life friends, when in fact, you agreed with what i was saying. I had no issue with your OP. I knew points in it were off, but it was a fine way to start a discussion. There are, however, two things you said that were dangerously incorrect, as follows. 1. "u don't understand the no-script add-on. it already prevents cross-requests as well by default." (from your post 28) NoScript does not protect against all such attacks, Cross-site request forgeries (CSRF attacks) being perhaps the most prominent example. (RequestPolicy adds this layer of protection.) So your statement is objectively false. It moves from just being false to being dangerous, because it is better to surf knowing one is unprotected, than it is to surf believing one is protected from something when one, in reality, is not. Since you were advocating a dangerous position, I asked you to stop. i never said it protects against all attacks, never even implied it. of course we all know that nothing does, so i think your premise is flawed. your logic on not having any protection being better than having some form of known imperfect protection doesn't fly. and even for those who don't realize it's not perfect and rampage thru malware infested pages, the chances of actually getting something with all or most types of scripting turned off is still much lower than using nothing. frankly, saying i'm giving dangerous advice was alarmist and disingenuous, and tore down (me and) thread, didn't contribute. quote:
ORIGINAL: RedMagic1 2. Your belief in the extreme importance of installing antivirus software (from your OP and numerous comments throughout the thread) While this was indeed the conventional wisdom until about 2005, at this point, just having antivirus software is like bringing a knife to a gunfight. It's not "wrong" to install, but it's not a priority either. In fact, if I could only install one of an antivirus, or Secunia, I would probably install Secunia. I will indulge myself in one technical sentence (and angelikaJ please consider sharing this with your master, as he might be interested): as of 2011, far and away the most prominent attack vector is zerodays on current and outdated forms of Java. In layman's terms, this more or less means that the bad guys have stopped writing viruses, and are now directly attacking programs already installed on your computer, to take them over (like Agent Smith in the Matrix), because the antivirus program won't notice if a trusted program is attacking you. This has gotten so bad that the prominent firm F-Secure advised its clients earlier this year to uninstall Java completely from their systems. Position 2 of yours is dangerous for exactly the same reason as your Position 1 is dangerous: you are encouraging people to believe they will be protected if they do X, when the truth is that they won't. first, i recognized the first premise of your point, that it might not belong everywhere, with this question, which u ignored: "maybe u were thinking of not running it on some resources within the firewall, or within a DMZ. " all the great points/opinions you're making now about where the biggest risk/threat is, well, great - that's good info. ----------- i think you dismissing two of my suggestions (without explaining as you've done now), to people who replied directly to me, was passive aggressive, and invited my replies. and again, this is a forum were we can disagree, and it doesn't have to be confrontational. you had excellent information to add to what i had said, as well as new info. but again, i disagreed on how u did it. can we agree to start over moving forward? i will do my best to, well, not exactly sure here, but to avoid being confrontational with you.
|