Wow. Totally unprofessional when you compare it with today's security bulletin standards. This downplays risks and blames the user. Was this common back then?
I haven't seen a more blatant exposure/confirmation of the deep-seated authoritarian control-freak mindset that has permeated the whole computing industry.
Yes, back then it was common and expected that users were responsible for their own decisions. Now the industry is taking away that freedom and telling them it's for their own good.
Can I use this as a testimonial? Chill... at least if you want me to discuss this further.
> Yes, back then it was common and expected that users were responsible for their own decisions.
You do not chose and decide to be victim of a scam. At least I presume the "if you wouldn't have downloaded hacker stuff from weird websites you wouldn't have caught malware" was as wrong back then as it is now and is just shifting the blame to the user.
You should not be operating a computing device if you don't know how to use it. This was true back then and it continues to be true now.
What percentage of car drivers are fully qualified vehicle inspectors?
Do you know how to fully use your phone? Would you be aware if pegasus spyware was installed?
AFAIK, all car drivers are required to go through specialized training, and pass through periodic skill examinations. You should not be (and are legally forbidden from) operating a car if you don't know how to use it.
Not in the US, at least not anywhere I've lived. The only regular re-examination is an eyesight test. There is no skill testing after the initial license issuance, and there won't be unless the license status is fully lost - waiting too long after expiration, revocation, that sort of thing.
And, at least in the state of WA, that "eyesight test" consists of a checkbox on a form that says, "Your eyes aren't shit, are they?". I've checked that box, and I overheard a person well past retirement age tell the same story at a restaurant. I get regular eye exams, but I don't know about the guy at the restaurant.
The last time I took a physical skills test was 40-some years ago. The last time I took a "written" test was...I don't know, ten years? And guess what? I still remember getting a question wrong on that test (despite having lived in WA for over ten years at the time), and what do you know, TIL something about WA road laws. They should test me (and everyone else) more often, and not make half the questions "how much can you drink and still safely drive?"
You don't need to know how a computing device works fully to know not to execute exe files you find lying around.
We expect certain minimum skill in operating equipment
Now open an email and have it silently install exploiting a bug in your mail client/browser/network stack, that's one thing. That wasn't this though, this was some software which did exactly what it said on the tin.
Didn't know that. Thanks for telling me instead attacking me like OP :/
I'm not certain what GP is on about. There were copious ways to distribute (deliberately payload) infected files back in the day and it was common windows user practice to just download and run executables (especially if they appeared to be installers from reputable-seeming websites) and zero free virus scanning or firewall options were available: all were for pay and all were terrible. None certainly shipped with Windows itself.
Plus as mentioned elsewhere plenty of third party software like ICQ enabled benign-seeming mechanisms to view documents which could be exploited to instead run infected executables.
I do agree some types of people would find that "professional " but I won't be one of them ..
Not that I can't imagine Microsoft actually doing that...
The closest you get this is sort of thing now, which is completely automated and frequently wrong, and assumes you know what CVE you were searching for.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
One of the bigger vulnerabilities in recent times was Printnightmare, where they did write ups like this due to visibility. I don't feel it actually says much.
https://msrc.microsoft.com/blog/2021/08/point-and-print-defa...
There were a lot of Twitter threads about the shitstorm that I can no longer find back when all their bulletins changed formats, but the general reason was moving their "good" bulletins behind an E5 license. Which again, I know some people consider "professional".
So to actually answer your question, here's a screenshot from a paywalled security bulletin. You can see from the scrollbar I'm near the top, and the "Recommendations" are all Defender features (with "apply patch" almost a hidden detail). The statement about configuring AMSI is not a Sharepoint recommendation, it's a Windows security feature originally tied into Defender.
And everything from here on in this security bulletin on to Sharepoint vulnerabilities - of which very little useful technical information is presented - is about Defender.
Of course, not just the EDR, the first point is about EASM, a feature licensed on top of Defender. The detection hunting details further down require a P2 license on top of that to be able to use.
Despite all that, it's not a fair comparison. I can't find anything in the E5 portal that is a reflection of this thread, where MS respond to a backdoor people are installing on their own.
I only know the mostly autogenerated MSN Developer Resources. not helpful.
Getting backdoored isn't a problem with the OS if you install the backdoor yourself