Skip the anti-virus. It's not that there aren't viruses, it's just that anti-viruses don't protect against them and increase the attack surface.

I'd say this, but recently I cleaned a few family members of root kits. They had virus scanners, they just didn't pick them up.

I'd love to know a decent one I can put on thats cheap/free that catches these fuckers.

Would save me a ton of time lol.

Clean install from scratch and mandatory automatic updates from the OS vendor.

Also, restricted privileges (Windows problem, mostly). You just don't need to be an administrator to browse the web, check your emails, play games, sort some photos or video chat. Remove this vector and save yourself a lot of pain.

The best thing that could happen to Windows is a user-privilege level where instead of providing a UAC prompt to the user when a program tries to elevate, the UAC daemon instead sends off a push-notification. The "real sysadmin" (e.g. nephew) would then install some app on their phone, which will catch these notifications and prompt them to remotely approve/deny the elevation requests. Or maybe even just make it non-interactive: default deny unless they've given an explicit elevation authorization in the last 30 minutes. "Phone me when you want something installed and I'll enable it." Sort of like a remote version of wi-fi router WPS pairing.

(Obviously, you can also build this for corporations, where the notifications are emails and managers can approve software installations on workstations and such from their email client. But corporations already get the benefit of "managed app stores" for frontloading software approval; they need this much less than individuals do.)

You know this right here, would save me many many head aches.

Yep, agreed.

Linux has exploits in the wild, too. Automatic OS updates is the important part.

That is only valid advice for an advanced user and even than is still debatable...

It's actually counter intuitive but in practice, anti virus are useless for non advanced users because they don't understand it.

A normal people get a message "Virus win32.badthingy detected: -delete- -quarantine- -ignore-". He clicks on the little "x" in the corner of the window.

-- true story

Your actual argument is the stupidest of the stupidest users can't read a prompt so AV is useless for any user? LOL

In what sense is it only valid for advanced users? And how is either claim (1. doesn't protect / 2. increased attack surface) debatable?

1. AV solutions do in fact offer a lot of protection. 2. You will reduce you attack surface a lot more by not installing Flash, Java, and using an ad-blocker than not using AV.

Do they, though? Everything I've read over the past 5 years has claimed an 80-90% miss rate. On the other hand, often the first sign I see of an infection is that the virus scanner is disabled, so I suppose it acts as a kind of canary, in that sense.

I can't really argue with you if just going to make up stats... I have been helping non-tech savvy family, friends, and co-workers for over 25 years. The ones who didn't have AV installed or let the one that came with the PC expire had a almost 100% infection rate. Once I installed a good AV product infection issues with most of them was not an issue again. Yes, nothing stops stupidity 100%.

25 years ago, I'd be right with you. 15 years ago, too. Since then? I think your anecdata are outdated. Things just aren't going to be caught by signature-based scanning anymore. In terms of automated detection, the bad guys won. "Good" AV detection, if there is such a thing these days, are the tiny vendors that infections aren't designed specifically to fight against. All the big names get disabled, or otherwise rendered non-functional.

I don't agree with you on (1), so I think we need data.

(2) is creating an entirely different argument from blue sky. You're putting words in my mouth.

I support installing ad-blockers to reduce attack surface.

Removing Flash and Java is more nuanced. Most non-advanced users expect Flash sites to work and many non-advanced users need Java sites to work (e.g. enterprise internal crap). I think click-to-play is a decent mitigation here that non-advanced users can understand.

Maybe disabling Java is okay, so long as they really do not need it for anything. Disabling Flash is a harder sell.

Well in my experience as I mentioned in another comment is regular users with no AV solution will get infected almost 100% of the time in a short period of time. The same users with a good AV product I usually don't have to deal with them again. I have no idea how anyone couldn't agree AV solutions have a use.

I didn't put any words into your mouth but was just pointing out better things to do to reduce your attack surface than not installing AV. Java is dead and I can't recall any site needed to use in years that requires it. Flash doesn't need to be installed standalone at all anymore and shouldn't be. When a site requires Flash I fire up Chrome which has Flash built-in and is of course way more secure.

AV does have limited use for advanced users... I have gone back and forth between having a 3rd-party AV solution installed over the years. I have a high end PC and the product I use has little impact resource wise so why thinking is why not?

I was writing polymorphic trojan horses 15 years ago. AV is long dead.