Hacker News Reader

Comment by jobu | Hacker News Reader

As the most technical person in my network of friends and family I'm often the one they go to for computer help. For years one of the first things I do if I touch their computers is install uBlock.

Lately a couple of them have gotten new computers and mentioned that they think it came with a virus because there ads everywhere on the internet.

View on HN

Same here. It's become one of those standards steps that you take whenever you set up a new computer:

1. Install the OS (or remove the crap-ware from the manufacturer)

2. Install the OS updates/security packs/etc.

3. Install the anti-virus

4. Install the ad-blocker

Skip the anti-virus. It's not that there aren't viruses, it's just that anti-viruses don't protect against them and increase the attack surface.

I'd say this, but recently I cleaned a few family members of root kits. They had virus scanners, they just didn't pick them up.

I'd love to know a decent one I can put on thats cheap/free that catches these fuckers.

Would save me a ton of time lol.

Clean install from scratch and mandatory automatic updates from the OS vendor.

Also, restricted privileges (Windows problem, mostly). You just don't need to be an administrator to browse the web, check your emails, play games, sort some photos or video chat. Remove this vector and save yourself a lot of pain.

The best thing that could happen to Windows is a user-privilege level where instead of providing a UAC prompt to the user when a program tries to elevate, the UAC daemon instead sends off a push-notification. The "real sysadmin" (e.g. nephew) would then install some app on their phone, which will catch these notifications and prompt them to remotely approve/deny the elevation requests. Or maybe even just make it non-interactive: default deny unless they've given an explicit elevation authorization in the last 30 minutes. "Phone me when you want something installed and I'll enable it." Sort of like a remote version of wi-fi router WPS pairing.

(Obviously, you can also build this for corporations, where the notifications are emails and managers can approve software installations on workstations and such from their email client. But corporations already get the benefit of "managed app stores" for frontloading software approval; they need this much less than individuals do.)

You know this right here, would save me many many head aches.

Yep, agreed.

That is only valid advice for an advanced user and even than is still debatable...

It's actually counter intuitive but in practice, anti virus are useless for non advanced users because they don't understand it.

A normal people get a message "Virus win32.badthingy detected: -delete- -quarantine- -ignore-". He clicks on the little "x" in the corner of the window.

-- true story

Your actual argument is the stupidest of the stupidest users can't read a prompt so AV is useless for any user? LOL

In what sense is it only valid for advanced users? And how is either claim (1. doesn't protect / 2. increased attack surface) debatable?

1. AV solutions do in fact offer a lot of protection. 2. You will reduce you attack surface a lot more by not installing Flash, Java, and using an ad-blocker than not using AV.

Do they, though? Everything I've read over the past 5 years has claimed an 80-90% miss rate. On the other hand, often the first sign I see of an infection is that the virus scanner is disabled, so I suppose it acts as a kind of canary, in that sense.

I can't really argue with you if just going to make up stats... I have been helping non-tech savvy family, friends, and co-workers for over 25 years. The ones who didn't have AV installed or let the one that came with the PC expire had a almost 100% infection rate. Once I installed a good AV product infection issues with most of them was not an issue again. Yes, nothing stops stupidity 100%.

25 years ago, I'd be right with you. 15 years ago, too. Since then? I think your anecdata are outdated. Things just aren't going to be caught by signature-based scanning anymore. In terms of automated detection, the bad guys won. "Good" AV detection, if there is such a thing these days, are the tiny vendors that infections aren't designed specifically to fight against. All the big names get disabled, or otherwise rendered non-functional.

I don't agree with you on (1), so I think we need data.

(2) is creating an entirely different argument from blue sky. You're putting words in my mouth.

I support installing ad-blockers to reduce attack surface.

Removing Flash and Java is more nuanced. Most non-advanced users expect Flash sites to work and many non-advanced users need Java sites to work (e.g. enterprise internal crap). I think click-to-play is a decent mitigation here that non-advanced users can understand.

Maybe disabling Java is okay, so long as they really do not need it for anything. Disabling Flash is a harder sell.

Well in my experience as I mentioned in another comment is regular users with no AV solution will get infected almost 100% of the time in a short period of time. The same users with a good AV product I usually don't have to deal with them again. I have no idea how anyone couldn't agree AV solutions have a use.

I didn't put any words into your mouth but was just pointing out better things to do to reduce your attack surface than not installing AV. Java is dead and I can't recall any site needed to use in years that requires it. Flash doesn't need to be installed standalone at all anymore and shouldn't be. When a site requires Flash I fire up Chrome which has Flash built-in and is of course way more secure.

AV does have limited use for advanced users... I have gone back and forth between having a 3rd-party AV solution installed over the years. I have a high end PC and the product I use has little impact resource wise so why thinking is why not?

I was writing polymorphic trojan horses 15 years ago. AV is long dead.

Do they ever ask what's going on when a page complains about running an ad blocker?

No. They do what you do: Leave the site and go somewhere else.

Actually does that happen? I though the Ad-Blockers by now reroute to similar pages, who do not bitch?

It did happen :D

I hope you inform them before installing it. If someone installed something that's tampering with my browsing experience without telling me I would be pretty mad.

yeah right! i don't know very much how to use a computer so i asked my cousin who is a professional hacker haha to set up the programs i use! i was blaffed to know that he installed a plug-in (that's how you spell it right?) that blocked all the ads that would appear in a website! how could i enjoy surfing the web without ads? real life has ads everywhere i go, so i called him immediately and ordered that he removed this "virus" that removed the ads!

Since you appear to want to learn, I won't feel bad (or pedantic) in explaining that he installed an extension, which is a browser add-on. A plug-in is also a browser add-on, but is used to describe QuickTime, Flash, Java, etc.

After I wrote the above, I double checked myself and, apparently, I am using Mozilla's definition. However, it seems Apple also differentiates among the terms add-on (the super-set), and extensions/ plug-ins (subsets).

There was an '/s' missing in his post.

I agree, especially since even ublock occasionally gets caught by those 'you're using an ad-blocker' ads that tries to get you to either disable it or subscribe. That would really confuse, say, my mom if she had no idea she had an ad-blocker.

I just tell non technical people to open those tabs in an incognito window which invariably works fine.

Removing ads isn't really tampering though: it's inarguably improving.

If someone makes my life immeasurably better without telling me, I'm thankful.

I wouldn't say it's inarguable. I'm not using Adblocker for many different reasons but that's not really the topic here. I think you should at least inform someone that you install stuff and let them give consent, regardless of what it is.

uBlock orgin

Reply on news.ycombinator.com