Hacker News Reader

Comment by Sohcahtoa82 | Hacker News Reader

I imagine there are some people clutching their pearls over not installing updates to Windows due to security concerns.

But for most home users, it's not a big deal. I imagine 99% of home users are behind a NAT, and being behind NAT means external attackers aren't going to be able to connect to your machine and run remote exploits (ie, EternalBlue). The only way to get compromised is to get trojaned, in which case a Windows update wasn't going to save you anyways. At best, it means a trojan might have a slightly harder time escalating to Admin/SYSTEM without getting caught, but a trojan doesn't need Administrator permissions to ransomware your Documents folder or add your machine to a botnet.

As long as your browser is up to date, you'll be fine.

View on HN

That wasn't the case a few months ago (maybe a year) where javascript payloads could be loaded hitting IPs on the LAN, so hitting millions of http(s) requests to IOT devices which would then get raw socket support.

Hitting default gateways for web admin panels etc.

I found the solution for Windows update though.Just don't use Windows. Microsoft can't be trusted.

How is that a Windows problem? Seems to be a browser problem, unless I'm misunderstanding the source of those JavaScript payloads.

Most of the “don’t update windows” talk, in my experience, comes from monolithic kernels like Windows 98/ME and Linux, where a single update can change or break a ton of seemingly random stuff. Hasn’t been relevant for 99% of desktop computers for 25 years (not counting Mac stuff).

> where a single update can change or break a ton of seemingly random stuff

That was always the problem with Microsoft: testing was done by the user. But until Win 7 they seem to have released the latest service pack for a given version (2k, XP, 7) with mostly bug fixes. Nowadays in Win 10 and 11 they bundle security updates with features and bugs go unfixed for months, if they ever are fixed. Microsoft organization, from quality perspective, is broken.

It is, but you still have the hybrid/micro kernel offering a surprising amount of protection by separating and compartmentalizing everything more.

Exactly. I don’t even have an anti virus and completely disabled windows defender because it was so annoying and everything just runs great. Also I’m using LTSC.

Unfortunately this is just anecdotal. I also did many things in my life that were risky, and I got away with them every single time. This doesn't prove that they were not risky, or that my results are reproducible.

That said, I also hate Windows updates, and especially the way Windows handles them. LTSC is also my way to avoid some of it, especially the ""feature"" updates. LTSC is something I also recommend, if people can manage an activation server, or I can point them to mine.

What risks, I’m not downloading random exe’s and executing them. I have been defender free since 2019 without issues. If you don’t play stupid games you won’t win stupid prizes.

Data can have malware, like jpeg, png or documents. The browser is not entirely self-contained, for some things it relies on system components, like decoding video.

What protects you, I think, besides your undoubtedly good practices, is herd immunity. Most every other Win user is "vaccinated" with antivirus, and so malware authors are not keen to pick on vulns that would get their thing flagged anyways. The MS policy of including Defender for everyone raised the bar, basically.

Reply on news.ycombinator.com