Hacker News Reader

Comment by umvi | Hacker News Reader

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.

View on HN

Every single person who installed Bonzi Buddy thought they were getting it from a good source.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.

You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

I don't think this is just a hypothetical either; if I remember rightly, a lot of the really obnoxoius unwanted software from that era was signed with valid, purchased signing certificates in order to encourage people to install it via ActiveX.

A trojan that steals banking information is going to be able to afford a certificate, but they aren't going to buy one because they would have to identify themselves.

> they would have to identify themselves

False. https://en.wikipedia.org/wiki/Identity_fraud

In order to understand this, you really need to start thinking like a criminal. "If I had money, power, maybe guns, and no conscience or care for anyone else, what could I get away with?"

You're imagining some mastermind criminal rather than some kid or for-hire hacker who finds an exploit kit and gets to work piecing together something malicious.

>but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source

I'm not sure whether that helps. The dunning-kruger effect will invariably cause novice users to skip those warnings because they think they "know computers", and "wouldn't fall for scams".

Reply on news.ycombinator.com