Years ago, I would have ended a similar rant with "what we need is designs that just don't do things like autorun and view-attachments-by-default"
But now, the "attack surface" has expanded inexorably to the point where the alternative to AV appears to be... none.
So this just seems to be the modern Internet, where the average user is more or less at the behest of rackets not much better than the rackets that control botnets if they aren't actually infected by them.
I've heard some botnets patch the system and expel other intruders. Yes, now, "everything is free... infection and protection equally".
It isn't nearly that simple any more and hasn't been for quite a time.
The Windows security model is not the broken mess it once was when properly used so the key problem is user behaviour particularly home users running as full admin, installing random crap without thinking about it (or simply not knowing any better), just clicking through any warnings they do get, and so forth.
If enough of that sort of user migrates over to Linux and kicks it into working the way they want (i.e. the bad way they used to work under Windows) you'll no doubt see the number of effective exploits balloon massively.
Jeff Wayne's Martians were right:
"The problem is, of course, the humans."
With alternatives like iOS, I feel it's simpler than ever to switch away from Windows. I'm not advocating using their closed ecosystem, but it may have some advantage. Especially for those grandparents etc.
That only works until enough people use an alternative. Then it will be interesting to start searching for bugs and security holes in the alternative. Just look at all the webserver exploits lately. Nothing is bugfree.
Still works now though so it holds true. However for instance Android is used far more than Windows and iOS is getting close and those are still not close the misery Windows is in this regard.
We don't really have a reliable measure of how many attacks are happening on Android and iOS, though. Unlike with a PC, users are much more likely to attribute malware-related problems to 'my phone is just old, I need a new one'. I would attribute this to a mixture of phone commodification (iPhone's appear to be pretty cheap thanks to subsidy plans) and the effects of cloud infrastructure. Users have basically nothing to lose by swapping out phone hardware, because what'll you do, ransom their contact list?
But now, the "attack surface" has expanded inexorably to the point where the alternative to AV appears to be... none.
So this just seems to be the modern Internet, where the average user is more or less at the behest of rackets not much better than the rackets that control botnets if they aren't actually infected by them.
I've heard some botnets patch the system and expel other intruders. Yes, now, "everything is free... infection and protection equally".
Is there an alternative?