@bontchev@infosec.exchange The problem is that even mainstream products and official installers rely on behaviours of this sort (“open a command prompt, type ‘curl url | bash’, and press enter,” for example). We had, and still have, the same problem with fake support calls in which victims are talked or pressurised into opening up a remote access tool to allow a criminal to control their computer remotely. People like you blame the victims for being a “idiots” who cannot be taught, but the victims have just as much right to denounce the “experts” - their own (possibly outsourced) IT team, their (possibly outsourced) security operations folks, and so on - as bad teachers because their expectations and the behaviours they demand of their users are so often indistinguishable from what the crooks do. Be clear - this is a world where one of the biggest and richest cybersecurity companies in the world can push out a telemetry-related signature update (one that benefitted the company more than its users - it was for reasearch rather than for vital threat prevention) that it didn’t test in any meaningful way at all, which triggered a buffer overflow *in a kernel driver* that could only handle 20 such signatures at the same time but didn’t refuse a 21st, which crashed millions of computers and put them into boot loops that required a BitLocker recovery key to escape from. Blaming users for their own cybersecurity troubles is sometimes appropriate - for example if greed or dishonesty got the better of them - but assuming that all dangerous behaviours are “obvious” is perhaps really where the idiocy starts…