Hacker News Reader

Comment by ItsMe000001 | Hacker News Reader

I run all such queries in a dedicated Linux VM so that I visit any "strange" websites only in that VM. I use a browser not connected to my (sync) account and don't login to any of my usual websites. uBlock Origin with all kinds of lists enabled is on, uMatrix is installed but it was too much of a hassle so it remains disabled.

I hope my feeling of relative safety is justified, but I'm not a security expert(?).

PS: Before anyone gets upset that I use such services, I'm not a heavy "pirate" by any measure. When I needed it I purchased software like Adobe Creative Suite or Jetbrain IDE licenses without hesitation. I only use it for things I don't really need and only use once, such as checking out a TV series (I very, very rarely watch anything, relying on specific Youtube and Twitch content instead, leaving two - one came with the apartment rent, one with the Internet - cable TV subscriptions unused).

View on HN

I wonder if I am doing too little in comparison?

I just use incognito and adblock. My impression is that whenever there's a remote code execution bug in chrome it becomes big news (ex: Meltdown/Spectre) so usually I can just trust the browser sandbox. Surely anyone with an exploit that can break the sandbox would use it on high value target rather than wasting it on the mass and having it get patched quickly?

I think I've become complacent since it's been more than a decade since I've gotten a virus/malware just from clicking a link.

> it's been more than a decade since I've gotten a virus/malware just from clicking a link

I'm worried that I probably would not even know when/if I have any malware unless the malware detection actually manages to detect it. I think lots of malware tries to remain inconspicuous and not draw attention to itself, only using your machine as a gateway or data source. Even though I know TCP/IP inside out and could inspect my network traffic, there is soooo much stuff going on in today's PCs that I have no intention of even trying.

I would not even know where to start if I had to inspect my operating system. I remember many years ago when a friend's laptop was always buys and created lots of network activity, it was obvious and easily confirmed that it had become a source of spam emails. I think a lot of malicious code is quite a bit more sophisticated and careful now, plus, the much increased bandwidth and raw PC power most people have available lets the same activity go unnoticed that 10 years ago might have had noticeable effects.

That means I think that not noticing any malware nowadays is not proof of absence of malware when the base rate is included, i.e. if we assume a low number of infections assuming no malware gets it mostly right only because of the that, not because we have a reliable way to detect it. If the base rate changes and our assumptions about infections don't change that would be a sign that our own ability to detect infection does not play a role in how we get to our assumption. It would be an interesting study to compare measured infection rates with how safe users felt (if it is the same user population for both). AV vendors and Microsoft might be able to do that.

>I think I've become complacent since it's been more than a decade since I've gotten a virus/malware just from clicking a link.

The dangerous ones are precisely the ones you don't know about.

> I hope my feeling of relative safety is justified, but I'm not a security expert(?).

If you want to be properly paranoid, you should consider getting a VPN. If you're not hiding your IP address, hiding all the rest is of limited utility. A VM doesn't really provide much meaningful anonymity - if someone wants to prosecute you for piracy they'll start by finding the IP address that was downloading/sharing the stuff (that's publicly visible).

On the other hand, it's pretty likely that this sort of paranoia is totally unnecessary - piracy prosecution against individual downloaders has been historically a PR nightmare for the groups doing it, and more or less everyone seems to have given up on that particular approach.

Still, if you want to be paranoid, a VPN will do a lot more for you than a VM and some add blocking.

If you are properly paranoid, a VPN won't offer much anonymity. VPNs may still keep logs (even if they say they don't, or when they receive NSLs they may be forced to do so).

For real anonymity, Tor is a much better option. Especially if used from a distribution like Tails.

I don't want to hide my IP address. I'm not paranoid about being found - nothing I do is illegal (I don't download, I watch streams, and that isn't illegal here, only if I downloaded the videos). For me it's only about system security, not legality. The latter would not be helped at all by using a VM.

As you said in another comment you are German and this is a very common false myth in Germany:

Streaming pirated content is exactly as illegal as downloading in Germany and also the whole EU.

Here is a source: https://www.focus.de/digital/praxistipps/anwalt-zu-eugh-urte...

As I said, I don't care about the legal question and my post was about system security only. Otherwise it would have been completely futile to mention the VM since that does nothing at all for the legal issues.

The illegality-of-streams question is not really relevant unless you are a premium account customer of a portal the authorities might get access to, or any streaming website they might get access to. They have no (legal) way to find streamers if they have no access to the server and/or whoever is hosting it or owns it. They get (non-VPNed) torrent downloaders because it's legally possible to find out which IP addresses download and/or offer a given file.

https://www.chip.de/news/Illegales-Streaming-auf-kinox-to-so...

In the past I did download torrent file videos - only to watch them exactly once or never. I got caught and paid the "Abmahnung" - so what. I stopped because I don't really need it. My need for such video content is very low. Usually I watch 10-30 minutes of movies, even "block busters", and then I'm too bored to ever watch the rest. For example, I still did not watch Game of Thrones past the end of the very first season.

So all streamed content is illegal in EU? YouTube, Netflix, ...?

How is a user supposed to know, for all anyone visiting a website knows it's licensed.

Anything on Netflix might be unlicensed, I have no way to tell, same with any random site. If I can find it, that means a large media corp can, so surely one must assume if they didn't get it taken down (sites are blocked and taken down all the time, blocked at ISP level) then it must be OK with the large rights holders.

And of course we know that even stuff from MPAA can be copyright infringing. There's no way for users to establish if something is properly licensed because license are secret.

Being disgusted by the viciousness of the anti-piracy movement mostly gave up US made movies and TV shows. I used to watch many shows and movies every year, now it's just one show and a couple of movies a year - in other words, almost nothing. And that makes me very proud and happy, they deserve it. Don't even go to cinema much.

Instead I watch Youtube: lectures, documentaries, courses and music. Reading Arxiv papers is stimulating and interesting. Streaming anime can replace US shows quite well. Don't need US entertainment after all.

Reply on news.ycombinator.com