Hacker News Reader

Comment by tux3 | Hacker News Reader

Counterpoint: I have a very non-technical friend that visited recently, and I was horrified to see that her macbook was full of malware. She casually talked about how someone stole money through her credit card. An AV scan actually found something on the laptop.

The AV industry is, unfortunately, terrible. Also unfortunately, some people really need them. I have no idea how one even gets a virus these days, but it does happen. People really do get infected all the time, and basic security advice that people get is not up to the task.

View on HN

> her macbook was full of malware

I’m guessing her OS was very out of date? Because I’m having a hard time imagining how this happens in 2024 with XProtect, Gatekeeper, and Notarization all turned on by default. Non-technical people are unlikely to turn these off.

You don’t need to be very computer savvy to google “how to bypass gatekeeper”. My kids figured that out pretty quickly.

Scripts (OSX ships with Python, Perl, Bash, Zsh, and I think JS) bypass all of those.

Also I would not be suprised if editing scripts in runtime based apps (like electron) still bypass all of those.

Last I looked at code signing in MacOS it was weaker than Windows in places. With code signing checks enabled in Windows (they are used as a smart screen signal but not required by default) you actually need to sign shell scripts to run them.

> OSX ships with Python

Small correction: macOS (it hasn’t been called OS X for close to a decade) hasn’t shipped with Python for a while. It does have a shim at /usr/bin/python3 that when called pops up a GUI to the user telling them they need the Xcode Developer Tools, which if accepted does provide Python.

Phones are a bigger problem. Nothing stops people from installing applications with insane permissions.

The basic security advice is install adblockers everywhere. You see someone using a browser without it? Talk to them.

Phones tho have a default security model which isolates apps from each other, unlike desktop OSes where each app can read anything on the system

I wish desktop OSes had evolved with such a model in mind. There is no reason why a calculator should be capable of reading my downloads folder — in fact, I'd even prefer it if I had to give explicit permission to access my network, Internet included. Maybe software wouldn't be so liberal with data collection if we had started requiring such stringent permissions way back when.

That’s how macOS permissions work.

File access for apps is gated behind “special” folder access (like Documents/Downloads/etc, and “full disk access” which is anywhere beyond the common user directories)

They evolved from a starting point pre-internet

It's not profitable to make operating systems secure because that encourages use of cracked software, and such software is where most malware comes from.

Use flatpak, add an immutable distro and you can do what you desire? Or just run Qubes-OS.

Isolated from each other, but not from your data.

iOS has always isolated apps from your data. Android has isolated apps from your data more and more with previous Android versions where I think they're finally on a similar level to iOS (where an app doesn't just have full access to your local storage by default and also isn't able to request access to sensitive directories).

About the only protection most third party AV provides is that it so badly cripples computer performance that PCs become incapable of running sophisticated malware

@nayuki Did this comment change your mind?

Reply on news.ycombinator.com