There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe
Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game.
Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks.
Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else.
And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks.
>tech people who think if you do X then you're totally safe
Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.
That is of course something that shouldn't happen, but it's not a particularly severe threat.
It’s not that botnets are a myth, but there’s some users who actually do click on scams and let people remote into their machines.
Just because botnets are real doesn’t invalidate GP’s points.
[0] https://www.google.com/search?q=aol+number+of+customers&ie=U...
I don’t know anyone who thinks they are totally safe.
But I know a lot of tech savvy people who don’t run anti-virus or any countermeasures and think they are acceptably safe.
I know it’s cliche to link to xkcd, but this comic seems relevant… https://xkcd.com/463/
Using a native AV that does basic heuristic detection is fine and dandy and usually comes with a low performance penalty and requires few rights that other parts of the system do not already have.
Using a non-root user for the daily grind and switching to elevated privileges only if required, running a PiHole (or a software adblocker) and monitoring outgoing traffic using Littlesnitch or LuLu likely comes at a better attack surface/performance/security trade-off, though, AFAIK.