Do you shop for clothes? You don’t pick your own cotton or gather wool from hedges? Colour the fibres with dyes you’ve crafted by hand from natural substances? Then spin it for weeks to get some thread? Then knit trousers or weave your t-shirts on a loom? Hah. I suspected that.

I assume you hunt and gather all your food? Prepare all your meals from the ground up? You don’t do that either?

Idiots. Clearly, you have only yourself to blame if your clothes are infected with smallpox or anthrax and your food is infested with deadly puffer-fish poison and laced with a radioactive form of cyanide.

Do you obtain your own water and do your own sewage treatment? No again? Whose fault is it if you get cholera, then?

Sound familiar? This is the response from some fraction of the geek world to the cyber-security problems of mere mortals.

The Register had a post about Google poisoning.

Hackers re-poison Google search results
Hackers have responded to a purge of malicious links within search results by Google with a fresh effort to subvert the search giant’s page rank system.

This links to an earlier post

Miscreants subvert search results to punt malware
……The tactic involved gaming search engines’ ranking systems by automatically posting links to malign sites in blog and forum posts. Hackers automated this link spamming process using networks of compromised zombie PCs……

This is pretty close to my heart as I have identified this happening on this blog over the past few days – including 12 hours on Thursday when I couldn’t even see any sites on the blogs server, let alone post to the blog or read T_W’s posts. A 6 month-old post was being constantly hit by Google searches for 2 products which definitely were never mentioned in it – some dubious UK Insurance company and an IP sc4nn3r. (Me trying to stop those terms actually coming up in Google.) By some miraculous coincidence, Akismet was reporting large amounts of blogspam by companies that claimed to offer those very things…..

I googled, read forum posts and looked at geek sites for a day and decided it was a CSRF attack or something, although, even if this was right, the only solutions I could find would involve days of applying half-understood*nix techniques to a server that I don’t have any admin rights over.

So the comments on a recent Register post really got my back up. They basically say that anyone who gets attacked by one of these things is an idiot.

Plus they are too idle to apply basic security procedures.

E.g:

Remind me again….
By Stone Fox Posted Saturday 10th November 2007 13:28 GMT
What the point of that comment is? I’m guessing pretty much everyone reading this is sufficiently tech savvy NOT to be the victim of stuff like this? and Not “get their life ruined by this stuff”?
And when you say “a BIT more difficult, you mean… “a complete arse!”

Stored Passwords
By Anonymous CowardPosted Saturday 10th November 2007 13:42 GMT
The whole scheme worked because the victims stored their passwords on their computer rather than in their heads. Regardless of the storage scheme, stored passwords are a security vulnerability to any software running on the storage computer.
Once again, the scheme is a low-pass filter and only nailed the stupid.

Yes, Gerry…
By David WiernickiPosted Saturday 10th November 2007 14:09 GMT
…I am sure that if every idiot and grandparent in the united states was running Linux there would be far fewer security problems.

Well, no. Every day, pages of the Register have stories about how major global organisations, with expensive IT security departments, get taken. Today’s Times Online has a story claiming that the head of the British security forces had written to 300 CEs and security heads of top British companies warning of cyberattacks from China. Are these addressees too ignorant  to take elementary precautions to protect their networks? I suspect not.

So how do the Linux nerds get so smug? The assumption is that you need a level of knowledge that goes beyond the average postgraduate computer security course just to have a broadband service and keep a blog. Plus, you need to live so leisurely a life that you have nothing else to think about than remembering 48 16-digit alphanumeric randomly-generated passwords. Alternatively, give up all your rights to run any forbidden programs to your ISP (other comments on same page)

This is absurd (see above) as well as patronising. Which is where I came in with the suggestion that some techies had better look to the general division of labour before they assume that the rest of us are to blame every time we come up against the sharp end of cybercrime.