submitted 11 months ago by ColdWater@lemmy.ca to c/piracy@lemmy.dbzer0.com

34 comments fedilink hide all child comments

Even the site that considered safe in the megathread, there's report of malware and trojan and I don't know what site to use

you are viewing a single comment's thread
view the rest of the comments

[-] httpjames@sh.itjust.works 3 points 11 months ago

Most come with DNS blocklists now that can prevent you from accessing it

[-] lukas@lemmy.haigner.me 3 points 11 months ago* (last edited 11 months ago)

DNS blacklists also don't protect you from most malware.

[-] FutileRecipe@lemmy.world 6 points 11 months ago

It's part of defense in depth. No single piece will protect you from everything, so you you use multiple layers of protection.

[-] lukas@lemmy.haigner.me 0 points 11 months ago

I can't call DNS blacklists part of defense in depth. DNS blacklists are a poor man's version of existing and pre-installed anti-malware software.

DNS blacklists block only older known malware, similar to existing anti-malware, but less effective.
DNS blacklists block hijacked, but legit websites that host malware, contrary to existing anti-malware.
DNS blacklists? What is that? I use DoH, get fucked. Contrary to existing anti-malware.

They're completely bypassable, they boast a high false positive rate due to how threat actors host malware, and they don't even block newer malware. Just use Windows Defender. It ain't perfect, but it's leagues better than any DNS blacklist.

[-] FutileRecipe@lemmy.world 3 points 11 months ago

Blocking older known malware still blocks them, so that's good (and saves bandwidth because the connection never happens, so this is really good).
If the site is hijacked, it needs blocked till it's unhijacked. So this is good as well.
This is not really a point?

Number one above, stopping the connection before it happens, is really the best benefit, in my opinion. And if they boast a high false positive, you need better lists. You keep saying "they don't block this or block that." They are (nothing is) a one stop shop. Simply because they don't block what you're cherry picking does not make them bad. Use multiple layers. You say "don't use a blocklist, use MS Defender instead." Why not use both the blocklist, MS Defender, and even more stuff? Multiple layers. Defense in depth.

[-] lukas@lemmy.haigner.me -1 points 11 months ago

Because Defender already covers what DNS blacklists block and more with less false positives and a proper way to manage exceptions for non-technical people. Older malware is a solved problem for Defender since it's literally pre-installed everywhere. VPN providers don't have a way to manage DNS blacklist exceptions, so have fun disabling your VPN to do any research. You also don't get to choose the blacklists your VPN provider uses. Saying 3. is not a point is like saying malware that's always able to bypass your anti-malware solution is irrelevant.