"If it ain't fixed, don't broke it."
I wouldn't use a condom that broke 3 years ago.
ok surely that firewall and home lab and ability to not download and run garbage is enough for someone on the supposed "hacker news" to handle. but no, we got heaps of people using "out of support" as some sort of argument whatsoever to upgrade to absolutely dogshit versions of windows. make it make sense
Having oldass OS and application versions make that a thousand times easier when you have so, so, so many CVEs you can exploit. And LLMs have been show to make this very trivial now.
All you need to do is click on the wrong pop-up, or the wrong link in your email, or tap something on your phone screen, or have a poorly configured (often from the factory) router, and the initial intrusion takes place. After that, an outbound encrypted session quickly gets setup, and congrats, now your network is acting as a residential proxy that can be sold to criminals that want to download CSAM from your IP, AI companies that will use your connection for scraping, and other elements that will either mine the data on your systems (your PII, logins, etc) and scrape your screens.
But if you don't care about your life becoming a living hell, then I can't make you.
This happens all the time, every day.
If you have a car, you maintain it. If you have a bike, you maintain it. Power tools? You maintain them. Your electronic devices also need to be maintained. They have access to your most sensitive data, and potentially private conversations.
https://developer.chrome.com/blog/local-network-access
Did you know that a lot of current home router NAT implementations are currently broken, in particular for UDP traffic handling, and you can therefore spoof your way into the network?
https://www.armis.com/research/nat-slipstreaming-v2-0/
A lot of router vulnerabilities floating around out there.
Ever hear of UPnP/UPnP2? Did you know that applications can trigger your router to open inbound ports for you?
There have also been some 0 click exploits lately, those are fun. You don't have to do anything at all!
https://github.com/Defense-Intelligence-Agency/Zero-Click-Ex...
Yeah, you're still at risk, and moreso because you're not aware of how open you are.
They're fine.
https://www.kicksecure.com/wiki/Unicode
It's also happened with code pushes on GitHub, which didn't get caught in code review, and has compromised build processes by introducing a malicious domain that is visually identical.
Sounds like a HN-type problem.
https://www.knostic.ai/blog/zero-width-unicode-characters-ri...
Everybody feels confident until a slip happens. It's really just a function of probability and time acting against you as well as anybody, just like companies shouldn't ask themselves whether they'll be hacked, but when.
It also seems to me that phishing has become vastly more sophisticated in recent years, IMHO mainly due to 3 issues:
1. A growing number of huge data leaks that enable scammers to profile and target possible victims to an unprecedented degree and attack them using unexpected vectors. I remember my feelings sinking the day I received the first phish that contained basically all my personal data to address me. Once it's out there and traded, there ain't no getting back. As a consequence, spear phishing has become much more automated and widespread.
2. Proliferation of 2FA, often via email, as a supposed remedy-for-all which leads to a false sense of security.
3. The sheer ignorance of some actors that continue to undermine all the best awareness efforts and normalize insecure practices. For god's sake, I've received unsolicited emails from my bank as well as from globally acting online retailers telling me to click on a link and log in to solve some issue. To my great astonishment, both turned out to be legit. What the hell were they thinking?
Really, I wish all of us good luck. But I don't feel so confident anymore, rather like an unwilling participant in a lopsided arms race, where the adversaries have great resources at their disposal, and I have nothing more to rely on than my wits. ... Actually, put this way, it sounds like a classic cyberpunk tale. There's some appeal to it, I admit, but still.
It isn't like this is the original WinXP during the era where computers connected directly to the open internet and caught viruses just by existing, making computers groan and being very visible that something was wrong. Pretty much everyone is connected via a firewall and on top of that Windows has improved its security considerably over the years. And there are still security updates for browsers (the main vector for malware by far) that support Win8.x (e.g. Firefox ESR will be supporting Win8.x until next year and people have made Win7 and Win8 compatible builds for modern Chromium).
So it isn't surprising that for all intents and purposes it isn't broken, especially when the alternative is having to change to something that feels like downgrade in terms of UX. From a user's perspective it is a choice between the unlikely potential of something invisible perhaps happening (getting compromised) versus the absolute certainty of something very visible happening (having to get used to a worse UX). Considering Windows still tie security updates with everything else, it isn't surprising that people judge based on what they perceive the most.
Of course the best solution would be to switch to an OS where such choices are not necessary in the first place. I've been using Window Maker since early 2000s and the UI has remained the same since 1997 when WM was first made, aside from the occasional theme change (which is done only whenever i personally feel like it, i.e. is not forced on me) while at the same time i'm using the latest Linux kernel, C library, drivers, etc with all security fixes. I do not have any choice between having security fixes or using a GUI that i am comfortable with - i get to have both.
The state of security is /awful/ for general users.
But they also can't figure out how somebody keeps getting into their email account, why they get text messages that quickly disappear from history, or what these weird charges that keep showing up on their bank statement are...
Software is "broken" even before it gets updated.
If what you said were true, there would be no such thing as a zero-day.