The good thing seen here immediately is that Lighting Gallery website itself is very well built. It is simple and easy on resources, without any dreaded "user experience", and works just the same as it does today
Viruses are foreign software which must arrive on the computer and be executed
Most of the time this happens through user action, ie. the user brings in and opens the stuff. So just not being an idiot prevents a big part of the problem in the first place
With the user out of the way, the rest of the threat is with defects in the normal software already existing on the computer, which would allow it to be hijacked (for example, into downloading and running all sorts of malware, viruses being one of them)
So, the problem is not the viruses (they are a consequence) but the possibility of he system getting hijacked to begin with
In the distant past, "basic" software and OSes were too dumb to have significant security threats facing outside through the network
If you install a fresh copy of Windows 95 and dont enable file/printer sharing, it probably won't have any listening ports by default
If you install a web browser from 1995, it probably doesn't support anything more than basic HTML rendering - No Javascrpt, no ActiveX, etc. The most that can happen is probably it running out of memory trying to load a big page, or failing to load a page altogether
Then things started becoming "smarter", opening new ways for things to be abused
Like the code execution from JPEG images in Windows 98. For the threat to materialize, the images would have to be downloaded to the computer and viewed with Windows explorer. So a possible way to catch anything could be to surf to a website serving such image, and going with Windows explorer to C:/Windows/Temp or the like before its contents are cleared
Windows XP is newer than that
It does have some default OS services interacting with the internet, each of which could have an open security defect
Web browsers used with it (which is anything from IE5 to browsers of ~2014) have complicated code execution mechanisms, which generally aim to execute the code only within the scope of the web page, but actual limits were anything from non existent (ActiveX) to badly flawed (Javascript, ...)
During the product's supported life, such issues are corrected once they are found (maybe or maybe not fast enough), so while the risks keep existing and growing (due to growing complexity of everything), there is an active effort to fix discovered holes
Once the service ends, new holes are still discovered but no longer fixed. Most of those holes are well abused already
New versions of Windows and web browsers are much worse than this in terms of raw possibilities of existence of threats
They are much more complicated, which creates more places where defects may exist. Modern web browsers have so complicated and capable JS engines that they require sandboxing just to keep the code running inside from accessing the system (if the engines would simply not implement anything besides some basic changes to the web page display, this would not be an issue)
Even with sandboxing, they are capable of running code which can abuse side channel attacks like spectre and meltdown. Again, probably would be much less of an issue with a JS engine which does not implement so much functionality (all of which isn't even needed for any proper websites, only for some extreme "user experience" stuff)
The OS itself has lots of services which interact with the "cloud". Some of which explicit purpose is to download and execute additional software on the computer
The only reason why this is considered safe is because the effort to fix everything by the software providers is ongoing. Once this system falls behind, it will become much more dangerous and much faster than e.g. Windows XP abandoned for the same period of time
In short, being mindful in general as a user, and closing system services which have an attack surface (possibly with the aid of a firewall), go a long way in securing a system
Existence of antivirus is not a significant measurement of how secure the system is
I'm on Linux since ca 2003
In terms of security of Linux (with everything running on top of it in a fairly standard desktop install) vs. the described systems above - Linux is on the complex side as a system, and the web browsers are pretty much the same as in other OSes. However, it has much better ability to configure it to reduce attack surfaces
Also, current and up to date versions run well on aging hardware. I have multiple systems running well on Core 2 Duos, and only a few years ago had some running on Pentium 4's, few of which may still be brought back to use as i expand my workshop
(Though right now in front of me i have a pile of just a few year old Lenovo and HP desktops, perfectly capable of any average use, that i saved from scrap - they headed there just because of Windows 11 TPM alola. Which have nothing at all to do with security in the normal sense)
|
