> No, we must assume everyone is too incompetent to distinguish between shady and legit software.

As someone who has worked retail in the past, and who currently works in IT: starting with this assumption generally minimizes headaches down the road.

There are only so many hours in the day: people learn what they need to get their job done, and tend to move on. Some people are quite dim, but others don't have the time/energy/motivation/need to learn the details.

I think us enthusiasts tend to lose sight of the fact that most people don’t care to learn about how their computers work, just like how most people don’t care to learn about how their cars work.

And pretty much no one understands to any significant depth all or probably even most of the technology they interact with every day.

Every discussion about the average user needs to start with https://xkcd.com/2501 to put yourself in the right mindset.

Proffeshionals can't distinguish vulnerabilities in their own fucking software, so we have no right to blame the users.