So what are the safeguards are on those Windows 10MB alternatives of unknown origin?
Reputation, simple. Don't install software unless you look at the reputation of the software maker and the reviews.
Also AV signatures of course. However there's no AV signature protection from running Java with the browser plugin and just going to a drive-by download or hitting a site with malicious code or a reputable site with malware from an ad, as it's likely so new and a different attack every day that it's almost improssible for the AV vendors to keep up.
Static software that has been complied weeks ago and download 1000s of times would likely have AV signatures written for it if it were malicious.
No I'm not. They are java apps I've downloaded.
Obviously you can initiate them via a browser if you want.
You don't need to run the app in the browser, the plugin just has to be there, it's exploitable. 99.999999% of users don't disable the plugin in the browser when they install Java and Java is responsible for so many malware infections through the plugin as it's almost constantly vulnerable, literally every time they release a new update the malware guys have it exploitable again and in the malware kits the very next day.
99.999999% of users don't disable the plugin in the browser
I always disable plug-ins and everyone should.
What I object to is people like Apple wanting to 100% own what we can and cannot run on our computers.
There's already potentially half a million + pieces of malware in app stores. That matters less because they all pay their fees.
In exactly the same way we get warned about java we get warned about Android. They all simply want profit by owning the web. Nothing does it better than scaring the sheep.
Have you never wondered why the zillions of holes in Windows and even OS/X get little publicity before they are finally fixed?
I wouldn't bother having Java in the first place, as I say just look for reputable software, even freeware and open source with a reputation is fine.
You have to have an OS, you don't have to install Java, that's the difference. Also most Windows vulnerabilities need other things to happen for them to be taken advantage of. Java breaks my personal security rules of installing unnecessary code that is highly vulnerable, and OS is necessary and you can manage, patch and do other things to make it more secure. Once you install Java you have an additional layer of regularly exploitable unnecessary code running.
Some of the software I have installed is the stuff I trust and have checked is ok. If you stay away from newly compiled and rare stuff then you are generally fine. As I say AV signatures for non reputable or malware infested software that has been out for a while are likely to have been built, meaning just downloading the executable you'll be told before install that it's bad.
The malware guys typically don't distribute malware in software, it's far too slow and hard work finding hosting for 20MB files and convincing people to download them, hardly any malware is delivered that way now. It's pretty much all Java, Adobe PDF, and other exploits in browser plugins and phish links.
Quick, easy and mass infection within hours as the install base of Java is so huge. Choose your poison from the malware kits you've bought subscriptions to, trick an ad company, infect a web server and sit and watch as thousands of machines visit that site that have java installed and get your ransomware payments.
Repeat after me....
You don't need Java, Java is bad:D Just the very fact they bundle the 'ask toolbar' if you don't spot the checkbox is enough to make the decision for me.
Comments
So what are the safeguards are on those Windows 10MB or so alternatives of unknown origin?
No I'm not. They are java apps I've downloaded.
Obviously you can initiate them via a browser if you want.
Reputation, simple. Don't install software unless you look at the reputation of the software maker and the reviews.
Also AV signatures of course. However there's no AV signature protection from running Java with the browser plugin and just going to a drive-by download or hitting a site with malicious code or a reputable site with malware from an ad, as it's likely so new and a different attack every day that it's almost improssible for the AV vendors to keep up.
Static software that has been complied weeks ago and download 1000s of times would likely have AV signatures written for it if it were malicious.
You don't need to run the app in the browser, the plugin just has to be there, it's exploitable. 99.999999% of users don't disable the plugin in the browser when they install Java and Java is responsible for so many malware infections through the plugin as it's almost constantly vulnerable, literally every time they release a new update the malware guys have it exploitable again and in the malware kits the very next day.
What I object to is people like Apple wanting to 100% own what we can and cannot run on our computers.
There's already potentially half a million + pieces of malware in app stores. That matters less because they all pay their fees.
In exactly the same way we get warned about java we get warned about Android. They all simply want profit by owning the web. Nothing does it better than scaring the sheep.
Have you never wondered why the zillions of holes in Windows and even OS/X get little publicity before they are finally fixed?
You have to have an OS, you don't have to install Java, that's the difference. Also most Windows vulnerabilities need other things to happen for them to be taken advantage of. Java breaks my personal security rules of installing unnecessary code that is highly vulnerable, and OS is necessary and you can manage, patch and do other things to make it more secure. Once you install Java you have an additional layer of regularly exploitable unnecessary code running.
Some of the software I have installed is the stuff I trust and have checked is ok. If you stay away from newly compiled and rare stuff then you are generally fine. As I say AV signatures for non reputable or malware infested software that has been out for a while are likely to have been built, meaning just downloading the executable you'll be told before install that it's bad.
The malware guys typically don't distribute malware in software, it's far too slow and hard work finding hosting for 20MB files and convincing people to download them, hardly any malware is delivered that way now. It's pretty much all Java, Adobe PDF, and other exploits in browser plugins and phish links.
Quick, easy and mass infection within hours as the install base of Java is so huge. Choose your poison from the malware kits you've bought subscriptions to, trick an ad company, infect a web server and sit and watch as thousands of machines visit that site that have java installed and get your ransomware payments.
Repeat after me....
You don't need Java, Java is bad:D Just the very fact they bundle the 'ask toolbar' if you don't spot the checkbox is enough to make the decision for me.
There was a recent OS that removed some half decent maps and installed their own to really serve their ads better.
They all have higher powers to serve/pay. Those toolbars are sponsors. So are ads.
And that imgburn survives via optional bundleware.
I'm sure the guy could sell out for fatter dollars though.
Totally different topic though.
In some countries Windows is seldom used.