Don't forget hacked WordPress sites

>I'm relatively certain email is still the biggest attack vector

Why?

Because grandma clicks on the embedded file when she thinks it's from somebody she knows.

That tells us how the exploit works, now why this person thinks it's the biggest attack vector.

Most internet users are very stupid when it comes to tech.

I know, but I'd like to see the numbers. Do people in 2016 have the same email habits as in 1996? I don't know, but everywhere I look, people are running safer email clients, usually in the form of well-sandboxed applications that hide most of the sharp edges from the users. I'm willing to bet email is a smaller vector today than 20 years ago.

I would be willing to bet that the difference in numbers between people using email and people running JS is enormous.

Here's one:

https://heimdalsecurity.com/blog/biggest-threat-in-your-brow...

You mean this site that pops you into said article, but then scrolls you to the top of the page to shove advertising into your face without even letting you glimpse at the searched for content?

For that, this: echo '0.0.0.0 heimdalsecurity.com' >> /etc/hosts

How many users know how to edit their hosts file?

I think that it was more a statement about the distaste that the author holds for that godawful site than an instruction for users to follow.

My point was that the problem is NOT easily solved for the typical user.