|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
Just a off topic to patching topic….I was googling up for something and spotted this on the Salon.com web site indicating that they are running a be
[See the full post at: Patch Lady – how would you like to mine bitcoins?]
Susan Bradley Patch Lady/Prudent patcher
“Until the day that we only install software that is trusted and vetted, and we only let certain approved software to run on our machines we’re going to be in this situation. It will take time to move to that model. It’s not easy.”
I think there is not one, but two elephants in the room with this approach.
1/ Look at Google’s curated content there are many reports of malware which users download from what is supposedly a safe source. Quis custodiet ipsos custodes?
2/ Once you give up control of your environment to another you have in effect elected to be a slave. Who in their right mind would cede total control to an entity such as Microsoft, whose only interest is in making a profit regardless of consequence.
It’s a nice Utopian ideal, the idea of some great benign force working for the good of everyone but humans will need many millennia to evolve before it comes about, assuming we’re ever capable of it.
Who watches the watchers, indeed.
I think our dear Patch Lady is expressing a nebulous idea that, by figuring out the details, might yet be given a definite and practical shape and become a really good one. Not now, though: it needs more work.
But it is a starting place and direction, following which might get us somewhere better, some day. Maybe it’s worth giving it a thought. Or two.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
The apple IPhone app store is this model. How do you trust software now? How do you vet what you install now?
It used to be that having a system backup handy was just good practice in the unlikely event of some catastrophic event. Now we need proven image backup and another Windows system just to be safe from Microsoft’s own update process.
How times have changed, and not for the better!
Our Windows ecosystem as it stands now is still too loosy goosey. As long as we can install anything, malware can as well.
Being able to install anything I want, but with the risk that some of what’s out there may be malware? That’s an acceptable tradeoff. That’s THE acceptable tradeoff! I like it loosey-goosey; that’s another way of saying that it’s flexible and that the user of the PC is not restricted by some company’s marketing plan, as it is with Google Play, Apple’s App Store, and the Microsoft Store. If people are willing to trade in their freedom for a little safety, they need look no further than Apple; they’ve got that down to a T.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
To add to that, my being able to vet software myself – e.g., by running it in a controlled test environment before adopting it – is FAR better than assigning the task to someone else, whose goals most likely don’t align with my own. Ask yourself: Do you trust Microsoft to look out for your well being? More than you did 5 or 10 years ago? You know, that time when spyware was considered bad, when it was malware that did things like “opt out” operation and “no obvious way to cancel”…
“Walled garden” company stores may seem at first blush to improve the odds that the least techincal, least responsible masses of people might get less dangerous software, but the goal of the OS companies is clearly to ONLY allow you to get software from their “walled gardens”. Who really benefits from that?
We can see that the “Microsoft Store” hasn’t just blossomed with wholesome, high-value software in how many years now? It’s because it’s not as good an idea as they’d like you to think it is. Oh, and let’s not forget that they take a big chunk of authors’ profits to allow software to be sold there.
Sorry, but I believe I’m WAY better than Microsoft at determining what’s good for me and what is not.
-Noel
Okay, I’ll bite and take the poll! 😀
Ask yourself: Do you trust Microsoft to look out for your well being?
Undecided.
I think Microsoft wants to think they look out for their users well being.
Personally I don’t feel so well and find myself more on the guards, when it comes to Ms.
I too prefer to be put into the “Please, don’t take care of me. Just release carefully crafted updates and patches and leave the rest up to me”-group.
More than you did 5 or 10 years ago?
5 years ago I was an evangelist and a very grateful user.
Came from cp/m, ccp/m, dos, Win95, xp to Win7 and was both happy and pleased.
Windows 8… hmm. Windows 10 … eh, what?!
But okay, at least I’ve had a good +30 year run…
Sorry, but I believe I’m WAY better than Microsoft at determining what’s good for me and what is not.
Well, Microsoft clearly begs to differ.
At some point we’ll have to decide, if the hours spent fighting the Microsoft way, couldn’t be used more productive… I doubt Microsoft will bend under pressure, so I predict software developement under Linux will speed up.
Happy fighting! 😀
Nobody, that I’ve noticed, said that the vetting should be done by a commercial entity with its own money-making agenda.
Yet I’m sure I read this:
Our Windows ecosystem as it stands now is still too loosy goosey. As long as we can install anything, malware can as well. Until the day that we only install software that is trusted and vetted, and we only let certain approved software to run on our machines we’re going to be in this situation. It will take time to move to that model. It’s not easy.
The (IMO strong) implication here, because the discussion is in the vein of “Windows 10 S”, is that “we” simply CANNOT make the determination about what should be “trusted and vetted”, and that Microsoft CAN do it properly, without fail.
BUNK.
Please don’t presume to speak for everyone, Susan. In my eyes Microsoft is MOST CERTAINLY not heading in the right direction. Besides my experience, it seems to me that 3+ decades of general advancement of the state of the computing art – WITHOUT a walled garden – say so. Where have the real advancements been since, say, Windows 7?
People are not all irresponsible or incapable of making their own decisions.
-Noel
I, too, was very put off by that comment. What has happened to us where we now accept having a corporation take total control of our computer whenever they feel like it and do with it what they wish, dictate to us how and when we will use it and now what we will use it for? Is this completely insane to anyone else? There’s also the whole “well, I don’t have any problems, so it works for me! What’s wrong with the rest of you?” kind of attitude some people have with regards to this stuff which, to me, is extremely out of touch and has a condescending tone to it.
I have a crazy idea. How about we demand that authors of malware be held accountable when said malware causes loss of data or financial hits due to people having to take their now inoperable computers to a repair shop to fix and pay for out of their own pocket? It is bizarre to me that this type of solution is even suggested as a viable solution much less an acceptable one and by someone “in the know” about tech things? Is this really what things have come to? Surrender of your property to someone else for “security” reasons? Why even own a computer at all? What’s the point? Like an above poster said, you’re just paying money and stress to be a slave.
As for the malware aspect of this, it’s like if I show up at your house and take a bat to your car. I leave a note with my name on it just so you know who orchestrated this destruction and I leave the bat there with my fingerprints all over it, but you have to pay for all the damages in full and I am not, in ANY way, responsible for repairing the damage even though you know exactly who did it. On top of that, everyone is perfectly cool with this situation as though there’s nothing wrong with it.
Why is it not ok with a bat and a car, but it’s perfectly acceptable with a piece of code and a computer? Should we all just start leaving our cars at the dealership for “security” reasons or do we just start enforcing laws on these people and make them liable for damages to each individual computer they cause damage to IN FULL? Why do these malicious software creators get a free pass when they damage someone’s computer like that and this includes Microsoft with their often cancerous updates? The only reason people get away with this is because we have accepted it and we allow them to get away with it! It doesn’t have to be that way, but it is that way because we allow it to be that way and we accept it. The fact that this “surrender your property over to X corporation” is being bandied about as some viable solution is preposterous to me.
I bet malicious software would decline in a hurry if they could be sued for this kind of damage, but I guess that’s just crazy talk. It’s much better to throw our arms up and turn our computers over to MS which solves absolutely nothing except home users give up more of their privacy and more control over their computers. It’s a classic “fox guarding the hen house” situation and MS certainly does prey on their customers whenever it’s convenient for them. Some hens are now asking to be guarded by such a predator and are perfectly fine with that situation? Wow… just.. amazing.
I’ll decide what software is safe and what software I want to use. That’s why I decide to have a computer at all; for MY personal use, not with anyone else’s discretion for someone else’s personal use. Windows Updates are far more of a threat to security than anything in the wild.
From what I read, it doesn’t actually sound like it’s opt in. It seems more like they think they’ll be able to make people who run adblock run unwanted software on their computer. This is ridiculous on its face, because they will just block that, too. Half the reason for running adblock is the bloat that it adds to page, making them slower to load, more difficult to interact with, and, yes, even running up CPU time.
It also ignores the increase in mobile device usage, where using up CPU cycles is only going to make your site drain the battery more. And when your content is primarily stories that can be read about on other sites, why wouldn’t you avoid linking to that site? With adblock, at least people without it might be linked to your content. But if you make my PC run slow? No way I’m sending that to someone else.
It’s ridiculous to try and copy money making ideas from malware–software that people want removed from their system. Malware scanners explicitly have a check for bitcoin miners now, because having them is so undesirable.
The only way I see this sort of thing working is if it is truly voluntary, and the people who opt in know what they are doing and can designate how much is devoted to it.
The only way I personally would use it is if I am in control of who gets the money, and it becomes a way to help out people despite my lack of funds. Not because one site has tried to force me to support them.
No I would not like to become a coin miner for salon, not after seeing a subscription pitch.
You use your S mode and Microsoft store if you wanna, but that isn’t for me.
Until a few days ago… So far when processing and disk resources have been consumed most vigorously anytime it has been the antivirus solution fully scanning(?) the system even when setup not to. Optionally combining that AV activity when also telemetry gathering and/or Tiworker.exe is doing something, can become a malware like simulation as you describe. (Thanks again Mr. Brian for finding that script.)
Do all of the crypto hashing formulas get played out to uselessness after a (long) while?
My first thought was, this is just another vector for miscreants. My second thought was to never visit that site and my third is, to carry on as usual 🙂
Thanks but, no thanks.
I was going to write something very much like Microfix wrote above… If I were to visit a site that warmed up my CPUs, that site would get blacklisted in a helluva hurry.
The intent with blocking software downloads is not to prevent unwanted distractions – though that can be a welcome side effect w/regard to ads and malware – no, the intent is to disallow arbitrary un-vetted software from running on one’s machine.
Hasn’t the whole Spectre/Meltdown flap already trained us well enough to know that running arbitrary software from wherever is not – cannot be – “safe”?
A model where just any online server gets to download its software and run it on your computer without your checking the software first just isn’t valid, and it’s certainly no more valid today than it was years ago! Ask yourself: Have web-borne infections gone down? Are we safer than ever?
Imagine inviting every vagrant in your neighborhood in for tea. Except that web software is even worse – it makes itself up on the fly from components that come from any number of different places, just at the moment it is downloaded and run. It’s like when you invite each vagrant in they choose to bring in 15 of their friends to join them. And they wear heavy coats so you can’t really see what they’re doing in your house. There are so many of them that you have to hire guards, and while they may be well-trained the guards will never quite care about your safety as much as you do.
Wouldn’t be better just not to invite all these hungry vagrants in, and just to find other ways to get your information?
I suppose you could say that in this particular case the salon.com domain is being overt in letting you know how they plan to use your computer to directly make money off you (using your electric power), but who’s to say what’s actually in their software? And hey, if I actually wanted to mine bitcoins, I’d be doing it for me, directly. I imagine they’re testing the waters, and at some point don’t plan to ask permission.
And this is important: Even if their intentions are to do just what they say and only what they say today, your decision to allow them in means you’re tacitly accepting what they’ll do tomorrow.
Call me overly conservative, call me paranoid, call me old fashioned – I don’t care. I don’t get infections. I maintain systems that remain functional and efficient for as long as I need them to run, and I can still get the information I need from the web.
For what it’s worth, I just checked: The web site blacklists I use (and I trust them from long experience), which are sourced from a fair number of reputable online providers, already block 7 sites that end with .salon.com.
This is all, of course, just my humble opinion. I’ve posted it here to encourage you to think. Don’t just blithely go along with what everyone else does without knowing what’s really going on. Susan’s right; the number of people finding it necessary to block things from being downloaded into their computers IS increasing – for good reason!
-Noel
IMHO, I couldn’t agree more on your observations Noel!
We also don’t know what the future holds regarding these tactics/ of mining data slurping/CPU access etc..
Better safe than sorry 🙂
Question you have to ask yourself is:
Is the possibility of some (if any) financial gain worth compromising the security of your computer system or network now or in the future?
Noel, one issue I see is too many sites and software companies forget that they are guests on the user’s computer. If I decide to not allow your site, ads, or software that is my decision. If you want me to use your site or software respect my rights as owner of the computer.
I use an open source package called Dual DHCP DNS Server with my own mods. But it’s only one of several layers of protection.
Running uBlock Origin in a browser can be another – pretty good – one for protecting browsing activity. That tool seems to be able to handle large lists of blocked sites and patterns.
You mentioned using a custom hosts file – it’s not a bad idea as far as it goes, though things can get a bit sticky when the count of blocked sites gets into the tens of thousands. The system is just not built for that. And there’s no wildcarding (so for example a.adserver.com might be blocked, but aa.adserver.com would still be resolved). Not being able to block things with wildcards (as I can with the DNS server) means that entire domains cannot be blacklisted in one fell swoop.
Another layer of protection is to implement a good firewall package. The best one (IMO) available today offers management by site or domain name (vs. IP address), and can mix and match deny-by-default and allow-by-default behavior per application or system component. For example, the general approach can be deny-by-default for newly detected programs, yet allow-by-default with exceptions for selected browser applications.
-Noel
I do not allow bitcoin mining on my machines with no exceptions. Simply put I do not completely trust the software. Any site asking for this is permanently blacklisted. As far as ads go, I block them because too many sites have not monitored what is being sent to users. So if the ad based model is ever going to work, sites and the ad industry must clean up their act. It’s not ads that I object to but ads that demand my attention.
As for an ‘app store’ or a repository, I am not against them in principle as having a curated source for programs does limit the chances of getting malware. But a totally closed system would make me wary on a desktop. There needs to a way to install outside of the official repository. Ubuntu allows third party ‘PPA’s to be added to the repository list . Arch use the AUR (Arch User Repository) which allow users to add software to an optional repository.
There needs to a way to install outside of the official repository. Ubuntu allows third party ‘PPA’s to be added to the repository list . Arch use the AUR (Arch User Repository) which allow users to add software to an optional repository.
Not only that, but you can still install software in Linux the old-fashioned way too. For Ubuntu and other Debian derivatives (which also includes Mint), you can download a .deb file, if the publisher of the program offers it, which is a lot like a Microsoft .msi file in that it uses the OS’s built-in installer. Just double-click the .deb file in your chosen file manager (like File Explorer in Windows) and it launches the package installer with a description of the program you are installing. Click the “install package” button to confirm you want to install whatever it is you’re installing, and you’re done!
Until recently, one of the problems with Linux on the desktop for Windows users has been that there’s no universal installer that works in any version of Linux… those .deb files are great for any Debian derivative, but they won’t work on distros that use a different package management system like RPM or PacMan. Now, though, the FlatPak system is beginning to catch on, and it’s meant to work across all Linux distros. Most or all of the major distros now support FlatPak, and there are a bunch of programs that support FlatPak already, with more to come.
And, of course, there’s also the tried and true manual method… open the tarball (like a zip file) by double-clicking it in your chosen file manager, and it will open the archive manager (like the built in zip extractor in Windows or WinZip), extract the file to the directory you want it in, then create whatever links (shortcuts) or launchers (also kind of like a shortcut, but with more options) you want to integrate it into your windowing environment. It’s exactly like any installer-less or portable .zip programs for some Windows programs (often offered as an option alongside the traditional installer).
LurksAbout, I am sure none of this is new to you, but I want people nervous about Linux to understand that it’s not at all hard to install programs in Linux outside of the repos or PPAs, and is a lot like doing it in Windows. The days of everything being offered only as source that you had to compile yourself are behind us, though that option still exists if you want to use it too.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
The only problem with installing from a source file (deb, msi, etc.) is that updates must be manually done. My experience with Windows is this is a royal pain and it is generally not done unless the software nags you to do it. One major benefit of a repository system is all the updates are handle gracefully by the package manager regardless of source. With the Ubuntu PPA system, once the PPA is registered it is automatically checked for updates. The Arch AUR does the same. There are some differences between the two systems but it means there might be 1 or 2 applications that have to be manually checked not an order of magnitude more.
My main concern is not the users who frequent AskWoody but the average user who uses a computer and really needs it to handle all updates as nicely as possible.
If we’re going to talk about Linux vs. Windows, let’s talk about security. Specifically, the time which usually elapses between the discovery of a security issue and the time at which someone comes up with a mitigation, then a patch. Linux is generally much faster to react than Windows, and way ahead of Apple or Google. Why?
Because Linux is FOSS — Free and Open Source Software. The very antithesis of the Walled Garden approach. When there is a whole worldwide community of developers, any of whom can see and analyze all the code, security actually improves, and less malware is tolerated. This is the real reason Linux is more secure than Windows. Not relative obscurity.
The more proprietary the apps are, the fewer eyes are looking over the code for errors and security issues. The more open the code is, the less cover malicious coders have to conceal their actions. It’s as simple as that.
There is no such thing as a lockdown so tight that no one can crack it. But if everyone knows everything, no one can pull a fast one. Not for long anyway, without being called out by the Community. If everyone knows a secret, it is no longer a secret. Good!
-- rc primak
If we’re going to talk about Linux vs. Windows, let’s talk about security. Specifically, the time which usually elapses between the discovery of a security issue and the time at which someone comes up with a mitigation, then a patch. Linux is generally much faster to react than Windows, and way ahead of Apple or Google. Why?
Because Linux is FOSS — Free and Open Source Software. The very antithesis of the Walled Garden approach. When there is a whole worldwide community of developers, any of whom can see and analyze all the code, security actually improves, and less malware is tolerated. This is the real reason Linux is more secure than Windows. Not relative obscurity.
The more proprietary the apps are, the fewer eyes are looking over the code for errors and security issues. The more open the code is, the less cover malicious coders have to conceal their actions. It’s as simple as that.
I thought that myth had been solidly debunked in the last few years?
Linux kernel vulnerabilities existed for 5, 7, 9, 11 years:
Another Years-Old Flaw Fixed in the Linux Kernel
People assumed that open source software is somehow magical, that it’s immune to ordinary programming mistakes and security blunders. It’s not.
Heartbleed: Open source’s worst hour
Can we do it? Can we once and for all declare the “many eyes” theory dead?
In a nutshell: Just because something can be done doesn’t mean it will be done.
The theory doesn’t work because security code review is hard, mostly boring work. Those who do it well are probably being paid to do it for a living,
Shellshock proves open source’s ‘many eyes’ can’t see straight
There is a view that because open source software is subject to review by many eyes, all the bugs will be ironed out of it. This is a myth.
Review by many eyes does not always prevent buggy code
But apparently people will cling to their biased beliefs despite all the evidence.
I’ll take open source risks over proprietary code that masks deliberate malware (anything taking over my computer without my consent, for its own purposes… read W10). One reason Microsoft enjoyed such great popularity was because it was simple to use, lower in cost, useful, and allowed users to configure it and use it according to their needs. It is being redesigned to serve Microsoft’s needs… and because it is proprietary code the choice becomes accepting it, or abandoning it. IF they were sensitive to customer feedback, they would have changed course long before now… but the most recent forced updates from 1703 to 1709, targeting users who set registry values to 0 to disable telemetry tells everyone their intent to take possession of your machine. I’m not getting political, but there is a wisdom to having checks and balances. It used to be you could configure a Windows OS to send the level of telemetry you are comfortable with, deleting unwanted apps wasn’t even an issue because they weren’t added in the first place, and you could choose Word Perfect, or Libre Office over Microsoft Word, you could customize your desktop in a way that suits you, updates that caused problems could be avoided until fixed rather than soft bricking your machine, and your settings would not be eliminated or changed or ignored by a new update. What are the current checks and balances for Microsoft? They’ve eliminated or severely curtailed users choices, deliberately degrading, moving, confusing, blocking and ignoring them. None of that is descriptive of ethical behavior. The only action I know to block/balance such bad behavior is to move to another operating system, despite their limitations… and support the people developing ethical and open sourced code, just like I used to support Microsoft (when it provided a product I valued and wanted), by buying their OS.
Non-techy Win 10 Pro and Linux Mint experimenter
You can also see case reports of where police officers were killed by gunfire despite wearing textile body armor (what most people call “bulletproof vests”). That does not mean that the protective effect of the armor is not real or that the vests are useless– it just means that its protection is not absolute. Very few things are absolute; that’s not how life works. If we’re going to call anything that doesn’t offer perfect protection a myth, we might as well give up trying to mitigate risks at all, because nothing is, ahem, a silver bullet.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
That is a great analogy. Protecting as much as you can, will minimize the possible damage, but not eliminate it.
There are people who focus on limiting the arsonal of potential criminals/abusers, or limiting their access (illegal to do this or that, or live/work/surf in a ‘protected’ area). Many people are culturally conditioned not to be abusive of others, but there are plenty of people that are incapable of empathy, that need strict limits on predatory behavior, in all cultures and all walks of life. Too many predators offer ‘protection’ if you follow their rules, and allow them to market your resources (think about sex trafficking here). At first it looks appealing, and sometimes necessary for survival… but it is about power and control, and is abusive to even willing victims. Using that as a business model can have its power and financial successes… but it is exploitive at its core.
Even in prisons, where weapons are ‘not allowed’, and people are strip searched to prevent contraband from coming in, toothbrushes, pencils, combs, sheets, and clothing provided to the prisoners, can all be used as weaponry… with deadly consequences. More restrictive is not better… but predatory actions are often limited when they are visible to others and subject to adversive (to the predator) consequences. I’m not seeing less predatory malware out there, but somehow Microsoft is inflicting adverse consequences on those who they offer the protection of the ‘most secure’ operating system. Doing something ‘for your own good’ is abusive when it denies the ‘protected’ of their own choices… There is a huge difference between stopping someone from running in front of a speeding car, and preventing them from walking down the street (so they won’t risk getting hit) altogether. So having programs and apps ‘graded’ regarding safety and allowing choice is allowing someone to walk down the street. Anyone live anywhere where there are no car accidents, muggings, break-ins, thefts? Have you given up walking outside, going to work, visiting friends, in order to prevent being exposed? Do you want the local authorities to lock you into your house and allow you to travel only in the ways and the direction they allow, in order to protect you? I know that technology brings new devices, new opportunities, new terminology… but we don’t have to abandon recognizing, excusing, or promoting predatory behaviors just because they are clothed in so much “new” and “better” terminology. Don’t let anyone condition you into being a victim… not the ‘bad’ guys… or the ‘good’ guys.
Non-techy Win 10 Pro and Linux Mint experimenter
Elly, you wrote:
“So having programs and apps ‘graded’ regarding safety and allowing choice is allowing someone to walk down the street.”
If I read this correctly, then — finally — there is someone here that explicitly agrees with me!
There has to be a balance between seeking safety to avoid harm and accepting that some risks are necessary to ensure individual freedom, never forgetting that anything really worthwhile sometimes involves going ahead and making a gamble that can have dire consequences if one ends up a loser.
Having sources of reliable advice one is free to ignore is what I think is the best way to interpret the Patch Lady’s suggestion.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
I did not say that many developers’ eyes would eliminate malicious code or preemptively plug all security holes.
I don’t see the Walled Gardens or Microsoft/Intel or Apple or Google doing any better — indeed, they have shown themselves to be slower than Open Source in plugging holes when holes are found.
Between the lack of choice and the lack of better security, I see no advantage in closing off user options, which is what Susan seems to have been advocating for in part of her post here.
-- rc primak
Let’s just agree to disagree about this point and let the main discussion move forward.
-- rc primak
I prefer currency government-backed and bank-recognized. I’ve stayed away from bitcoin.
I won’t mine anything and have faith in my adguard and firewall will block any mining attempts against me…
Google is btw. banning mining…
Sessh wrote:
I have a crazy idea. How about we demand that authors of malware be held accountable…
They already are accountable by law. At least in by far the most places. Google though seems to be facing a law suit from a russian user, who thinks their crypto ban is illegal, but pleeease…
But I doubt you’ll ever see any money from anyone causing you to waste time/data on your system. If we could, wouldn’t Microsoft own us all a pile of cash by now?
I agree with those here who feel bitcoin or other ‘revenue generating software’ do NOT belong on my systems – for security and performance reasons. I also agree with those who want to fight the ‘walled garden’ ecosystem approach of so many tech companies these days. Essentially these are vertically integrated and potentially abusive (think anti-trust laws – whatever happened to those, anyway?)
But back to the issue of how websites that provide us valuable services are going to pay their bills as more people use tools to block ad revenue. It is a real problem going forward. I use many tools for blocking ads, cookies and a plethora of other tracking and fingerprinting techniques. I treasure my privacy and want to keep it. I also do not want to be surreptitiously manipulated by ‘Madison Avenue’ – or other interests that want to treat me as a resource to be mined. A tough row to hoe, for sure….
If valuable sites can’t pay their bills, they won’t be around long. Consolidation of the internet will accelerate. Pablum will proliferate. We’ll end up being manipulated anyway, if that happens.
Also, I try to support sites I highly value by donating or subscribing. I’d also support ideas maybe like micro-transactions for the number of articles read on a site, etc.. In any case, we get what we pay for in the end. As an example, I donate to AskWoody occasionally and will soon become a Patron. At the risk of sounding like a pitchman, maybe more of us AskWoody fans could step up to the plate…. 😉
Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.
I cannot agree more: unless there is some practical and generally acceptable money-making idea for the subsistence of a free press, readily available to the general public, that provides real, professional, journalistic information, not infotainment or partisan raves and lies, and that relentlessly probes into the doings and deal makings of the Powers That Be to reveal their conspiracies and shenanigans against their own people’s interests, the future would be either all-paywall, or all-gone-dark.
And our free society’s grievous loss, either way.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
I agree on most points here. Voluntary donations have not kept many sites afloat. I do what I can to help out AskWoody, but unless most people who post here and even some who visit without posting would donate significant amounts, voluntary contributions aren’t going to keep up with the costs of running this site, especially the forums.
This is why so many good web sites have gone over to paywalls. Subscriptions are not appropriate for news and information sites. But Salon.com is not such a site. For me the answer is simple — I haven’t found anything there recently which is not available elsewhere in at least the same quality.
Trying to force people to pay for a site by intruding on and hijacking our personal property (our PC hardware) is not just unethical. In principle it either is, or should be, illegal. Even as an opt-in, this way of thinking on the part of site operators reeks of desperation. I don’t like that smell.
So I never visit Salon.com anymore.
-- rc primak
I may have been responsible for one disappearing post, possibly the one OscarCP is replying to. I hit the wrong button when trying to Reply to the same post, then wondered why everything went red, then the post disappeared. I think I know now what went wrong, and I’ll try to avoid similar errors in the future.
-- rc primak
I use NoScript with Firefox, and I block all scripts except for those I add to my whitelist. I am hopeful that this approach will block cryptomining attempts.
Not having undertaken a “deny-by-default” approach to scripting yet myself (but still relying upon a reasonably sophisticated blacklisting process), I’m curious: Do you find that choosing whether to whitelist a script straightforward?
Let’s say a site (e.g., this one) wants to load “jquery.fitvids.js”… How do you vet that script?
I mean, I guess I can imagine trial and error, allowing as few scripts as possible from as few sites as possible, though I imagine that with that approach you’d fight each new web site for a while to get it to work right. Still, the concept of just not allowing software to download and run unless previously approved is attractive.
-Noel
I used to use NoScript years ago when I was using Firefox. I find that uMatrix is much better IMO, but that’s just me.
Noel,
I find that it really isn’t much of a hassle for me to tweak the settings for new sites and get them working right. uMatrix allows all first party scripts by default and denies everything else and most sites work well enough that I don’t need to tweak anything. You can easily turn it on/off for any site. I really only need to tweak things when I want to see an embedded youtube video, a picture or look at the comment section most of the time. Toggling things isn’t difficult. For me, I find it to be kinda fun because I’m always learning how things work under the hood. Once you get the hang of it, the advantages far outweigh any time spent tweaking.
Green entries are allowed, light red are second party which allow CSS and Image only by default and dark red are third party which are completely blocked by default. You can toggle stuff on (green) by clicking the upper half of any of the boxes in light red to turn them green. Click the bottom half of the box to downgrade it to light red again and click the bottom of a light red box to turn it dark red (third party status.)
Doing that on for any column along the top (cookie, css, image etc..) will toggle allow or deny for all of that column except for third party cookies which are always denied unless manually allowed via the column on the left or individual boxes associated with them. Toggling the columns at the top will only affect first and second party elements and connections.
Doing it for anything on the left column will toggle individual domains and their sub-domains. Domains also have dividing separators. You can also do that for individual elements (where you see the 1’s in light red) for example.
At the very top, you have the power button (turns if off for whatever site you’re on and doesn’t block anything), a padlock (saves any temporary changes you made for that website after you’re done), an eraser (reverts any temporary changes made) and a reload button for the website you’re on as well as a nice selection of options including blacklists accessible via the small, grey gear on the far left of the top border.
If I can do it, you certainly can. I think you will enjoy the control it offers you. I know I do. Been using it for over a year now.
Well since you asked…
That is a method when using default deny policy, yes some of it is trial and error while other script serving domains are plainly obvious. You can learn very fast what you only need to enable for some sites to still function. You can learn fast if there was a mistakenly enabled domain.
It is helpful to search about any info for odd looking domain names, especially when using shopping sites or any other domain listed in NoScript’s drop down menu.
Also, If certain non-financial sites need domains and scripting for everything enabled or it won’t work no matter the choice, usually that one gets no more recurring visits.
Do you find that choosing whether to whitelist a script straightforward?
It is very simple and straightforward:
* The first thing I did after installing NoScript was to remove the sites that the author put in the whitelist (there were between five and 10, as I recall).
* Now, as I surf the web, I generally allow scripts which are associated with the site I am visiting. For example, if I visit First National Bank, I find that scripts from “fnb.com” are trying to run. I conclude that those are evidently from First National Bank, so I allow them to “always run”. Or if I visit askwoody.com, I allow scripts from askwoody.com to “always run”.
Mapquest used to work if I allowed just the “mapquest.com” scripts to always run. However, I now have to let Google and other scripts to run as well. So for Mapquest, I generally allow all to “run temporarily” (just for that browsing session). Accuweather.com is the same way – it used to work if you allowed only the accuweather scripts to run; now you have to allow everything.
To whitelist (or blacklist) a script site, you simply click the button in the upper right of the browser window. It shows you everything that is trying to run, and whether or not it is allowed. One click changes a site from whitelist to blacklist, blacklist to whitelist, etc. It is extremely easy to do.
All Google-related sites stay on my blacklist. It is astounding to see how many sites are running Google scripts. Google truly has their tentacles in just about everything on the web. And some sites simply will not work if you don’t allow the Google scripts. For them, I either temporarily allow all, or I use Opera.
If for no other reason, you will find that NoScript is indispensable because it allows you to see what is running in the background.
NoScript seems to work well with uBlock Origin. Keeping both active on Mozilla Firefox.
@ OscarCP
You can add the NoCoins filter to the AdBlock Plus addon/extension.
By the way, cryptomining can be blocked completely (last I checked) with any of several browser extensions for Chrome, Firefox and other popular web browsers. I use one extension each on Firefox and Chrome to protect myself.
-- rc primak
I remember, from eons ago, a “Get Smart” TV episode where Chaos had invented the Anti-Anti-Anti-Missile-Missile-Missile, so Control had to invent the Anti-Anti-Anti-Anti-Missile-Missile-Missile-Missile…
Why does it always seems like inevitably that more software is the answer? 🙂
-Noel
Another long time voluntary use of the idle time in home computers for data research for amateur astronomers is the SETI@home project from UC-Berkley. https://setiathome.berkeley.edu/
Quite aside from compromising system security, what bugs me is this concept of “unused processing power”. There is no such thing. I run low-power CPUs and GPUs for a reason, a) to reduce my power bill, b) keep my house cool in the hot Aussie summer, and c) to reduce the carbon footprint (I’m currently renting, so I can’t put solar panels on the roof). When I do use my PC at full power, it’s when I game, but that’s for an hour a day on average. In between that I try to be as energy conscious as possible.
I do subscribe ($) to some news sources I have faith in and want to support, but any others that want to gain access to my PC to earn some money off my processing power can b***** off.
No matter where you go, there you are.
Several posters have suggested micro-payments as a way to support websites. IMO, over time this will become the main method that websites will rely on to stay in business. Paywalls are off-putting (what, you want me to pay $9 or $12 a month for your website that I chance upon three times a year???), while third-party ads are often annoying and all-too-often dangerous.
The new Brave browser offers a micro-payment system to support the websites people visit, although alas right now it’s based on cryptocurrency. But it’s a start and one of their FAQs says that they intend to add the ability to use a credit card to make these payments.
In this manner, websites could fund their operations, while users wouldn’t have to create a separate account for every single site they want to visit, and the fee for reading a given page could be pennies (or even fractions thereof) which would be less likely to drive the visitor away than having to set up a full-blown or even a “trial” subscription.
The classic reference for this and more, much more, and quite pleasant and even fascinating reading is:
The Extraordinary Popular Delusions and the Madness of Crowds”, by Scottish journalist Charles MacKay, published in 1841.
You might find a copy, or order one, at your friendly local bookstore, assuming there is still one near your place (alas! something getting rarer all the time), or else order a paper copy from Amazon. Or perhaps get one for free, on line, as an e-book, from the Gutenberg Project or similar organization that distributes copies of works no longer under copyright. As this one probably is.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
The classic reference for this and more, much more, and quite pleasant and even fascinating reading is: The Extraordinary Popular Delusions and the Madness of Crowds”, by Scottish journalist Charles MacKay, published in 1841…. Or perhaps get one for free, on line, as an e-book, from the Gutenberg Project…
Read it online at the Gutenberg Project.
Just saw this today in my inbox from AdGuard… https://blog.adguard.com/en/top-cryptojackers-are-video-streaming-websites-and-they-do-not-use-coinhive/
May or may not be interesting, but I for one do not accept to be milked without my permission… ymmv.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
