What do you mean? There's only 21 comments, only one top level comment is inciteful, and pretty much everyone is calling them out. There's nothing unusual going on in here.
They're super rare. I've not gotten one once in decades, whereas I've encountered countless viruses on Windows. Linux is more secure, but also it's just a smaller target. Best way to avoid viruses is to use an OS nobody else wants to use *taps head
I think you have a false sense of security with regards to Linux vulnerabilities and exploitations. There are dozen of known exploits throughout the Linux ecosystem that are publicly disclosed frequently.
What makes you think Linux is more secure than windows? I'm not trying to start an argument here I'm just curious.
I find the Linux ecosystem has far better updating mechanisms than Windows and it doesn't have as much backwards compatibility cruft as Windows. That and the open source nature I think is better at having exploits uncovered. I'm not saying Linux is perfectly secure, but that it's more secure than Windows. But I think the biggest reason it's less likely to get viruses is just that it's a smaller target and that hackers aren't spending as much time trying to attack it, plus the users are more tech savvy meaning any attacks will be less lucrative.
The target user base is much smaller. Most viruses are spread through user error and server administrators are far more competent than a typical OS user. Also, typical server exploits lead to exposing credentials rather than spreading viruses.
you mean because of the last two panels which are supposed to be the same?
I personally prefer this version, it always bothered me reading the same thing twice which didn't add much to the meme
What if they couldn't come up with a different format (even tho I may know different formats to use here I sometimes simply don't know their name (to search for their templates) or I'm just lacking the mental capacity to think of a more fitting one :')
Google "Only spy the web" is highly inaccurate...they are everywhere. In every website, in your android phone, in your YouTube, in your Google drive, in your email, in your Google maps...
i know you guys are probably right when you say that security updates are important, but why exactly? give me an example of how i could be fucked over while i’m just mindlessly playing my steam games and watching twitch+youtube on a system that hasn’t been updated since 2016.
i blindly assume that as long as i don’t download and run stupid .exes or click stupid links, i am completely fine
You don't need to click anything suspicious. Remote code execution has in the past been done through images, PDFs, comments on some webpage, or supposedly trustworthy games. Just recently, Minecraft would let an attacker run anything on the victim's computer due to a vulnerability in Log4j.
If your computer is not directly exposed to the internet, you might get away with some security updates that for example fix vulnerabilities that target the system firewall. But the point is, you're constantly exposing yourself to attackers without knowing so.
A few example vectors:
Cross-Site Scripting (XSS) allows an attacker to run arbitrary code on the victim's browser. All that's required is a website that doesn't validate its input properly. That is, an attacker can write executable code into a YouTube comment and when you view that comment, your computer will execute that code. Obviously YouTube is secured against that, but there are plenty of websites where this attack can be done. Therefore, modern browsers isolate the code execution to only that "browser tab", so the attacker can't access some sensitive data (unless the browser has some undiscovered vulnerability or for example the page itself contains sensitive information, say your bank account details). While modern browsers should provide sufficient protection against such attacks, the take-away point is that you don't necessarily need to click any "suspicious links". A vulnerability in a well-known website you frequent could be discovered any day.
An attacker can easily make your PC go to their website when typing google.com. DNS (how your computer is able to tell which web address is which computer) is not encrypted. It is incredibly easy tamper with. Why you don't get scammed everyday is because of TLS encryption. Your computer is able to tell that the website is not Google, because it doesn't have Google's cryptographic "keys". Assume that we discover a vulnerability in TLS (encryption of webpages) tomorrow and you refuse to update your operating system. Suddenly, an attacker can route any traffic they'd like back to them and you would be none the wiser. Same thing would happen if some vulnerability is discovered in X509 certificates, if ICANN's private keys are leaked, and so on.
There are a lot of things that could go wrong. And they go wrong daily. Security updates fix vulnerabilities that we constantly find. They may be updates for your browser, your games, or indeed your operating system, depending on where that vulnerability is. The examples I gave are exaggerated, because they're meant to be simple to understand. We do not find vulnerabilities in TLS every single day. Still, weak points are being discovered and fixed constantly. One of the bigger exploits were Spectre/Meltdown (attacks on the CPU) that let an attacker read any data they want, provided they can simply run some code on your computer in some way.
Also, obviously, if you expose yourself to the internet directly (e.g. port forwarding) or connect to an unsecure WiFi network, you'll be bombarded with automated attacks that exploit holes found in firewall and the likes. If you open a port on your computer right now, you'll get around a few hundred such knocks per day.
There are plenty of videos online that display what happens if you for example use a Windows 95 computer, either directly exposed to the internet or not. Might be worth watching to see just how easy it is for attackers to take over in the case of such an ancient system. Same principles apply to newer systems as well, the attacks are just more complex.
For web browsing, that almost makes no difference. As long as the browser is being updated, the most important attack vectors are closed. Even if there are any exploitable vulnerabilities on the OS, that will stop malware from even getting to them.
Absolute joke of a comment. You are assuming the browser is a holy grail completely isolating the internet from the operating system.
First of all. The browser runs on the operating system's services. In particular, the isolation that you implicitly cite is done entirely by the kernel. (That's for example why you cannot run chrome in an unprivileged docker container - the crucial isolation-centered system calls are not available) The whole network stack is managed by the operating system. Cryptography can also partially be done OS-sided. The simplest example is CSPRNG, which is usually provided by the OS. (Advanced systems may rely on external physical generators, see Cloudflare's lava lamps).
Secondly. Completely and utterly wrong. The linked video displays the execution of Meltdown/Spectre within a browser. Using JavaScript. This allows the attacker to gain access to any data they want on your computer simply by running some JavaScript code. Easily remotely executed via XSS on a poorly written website. You may read the full article here. Or inform yourself about Meltdown and Spectre here. How is that relevant? Combating this vulnerability was primarily done via critical OS updates. The exploits are inherit to certain CPUs and are therefore not fully fixable. Still, the combination of BIOS, Chipset, OS, and browser updates help prevent very serious attack vectors. (That's the reason why the browser's time measurement is only accurate to about the millisecond.)
So no. Browsers aren't the magic solution to everything (sorry Ubuntu Snap). They very much depend on the OS providing the assumed security guarantees. And even assuming no direct vulnerabilities in the OS, we can never exclude side-channel attacks, like what Meltdown and Spectre were (or still are if you refuse to update your system).
I will check that out! Mostly I've been looking for something to determine what files are no longer in use, like old configs for programs I don't even have anymore, etc.
I think pacreport --unowned-files might be able to help with that too. Showing you files that aren't part of any installed package. Probably only does system files though, nothing in /home
Can't be, I started using Linux just a year ago and Arch since November. I broke something, tried to rollback, broke it more. I learnt my lesson and now I read most of the docs of anything that messes with the system before even installing.
Please do share.
What better thing to do than to take a break from a broken install to read about someone's own hardship with the endless quest that is maintaining a rolling-release distro.
linuxmemes
Aktiv