This sentiment was expressed on OccupyWallStreet, with one suggestion being a $20/hr min wage, with guarenteed income regardless of work. Both your suggestion and theirs suffer from the same problem: If I do not have to work, why should I work?
More fundamentally, in all of human history, I am unaware of a successful economic system that made work optional for everyone. The reason is once again, if people do not need to work, they do not. There are a million and a half statistics you could look at, showing that once effort and money become decoupled, effort trends towards zero.
Further, if you somehow mandated it, so that 80% of the country literally did nothing, the other 20% would simply leave the country, making that 80% collectively impoverished.
This is really the first time I have EVER heard the protestant work ethic a bad thing, btw. Its generally credited with a number of things, and Wikipedia sort of sums it up as follows:
Hard work and frugality were thought to be two important consequences of being one of the elect; thus, Protestants were attracted to these qualities, seeking to be obedient to God to whom they owed their salvation.
Yes, what an awful thing-- frugality and hard work.
Love the ad hominem, but things arent that simple. I think they absolutely have the legal right to enforce their rights, and our system absolutely must allow them to do so, but I think the way they do it -- as well as their behavior-- reprehensible. It borders on an abuse of the system, and they are highly offensive. I also happen to be baptist, and the fact that they hijack the name and associate us with such nonsense doesnt help.
The problem with disallowing what they do is that it is enshrined in the first amendment-- right to protest, right to assembly, right to free speech. Does their speech offend you? So to does much political speech, and its a short hop from outlawing one type of offensive speech to another. Would the same folks decrying "free speech zones" really defend denying the WBC permission to gather on public property next to a cemetary? Or would they approve of trying to silence them by claiming disturbing the peace, etc? How would we feel if that were applied to us, if we were to demonstrate about something important to us?
This is the heart of the first amendment here, and its been addressed through the ages (neo-nazi marches, flag burning, etc), and thankfully the right of the offensive to be heard has always been upheld, because it is absolutely foundational to a "free country"/
Ive got 8GB RAM, hibernate works just fine, thanks.
More often I use hybrid sleep (not sure if its a windows, or a bios feature), which sleeps for a length of time (say an hour), and if I havent resumed, it wakes up just enough to flush ram to disk.
Means I never have to worry about sleep battery, or waiting for my laptop to finish hibernating.
Im not sure that HTTPS qualifies as "seriously heavyweight". A Pentium4 processor can handle about 400mbit/sec of AES SSL-- lets assume this is the home computer. Rendering the HTML, running scripts, and handling the flash content would comprise a far bigger portion of the CPU usage than perhaps 1meg of SSL'd traffic.
On the server side, you can right now get a $250 Xeon E3 1220L, using ~20watts, which can handle ~13gbit/second of AES traffic (with the AES-NI extensions). If thats not sufficient, you can always get a second one.
Encryption is now very cheap, CPU-wise. (P4 stats taken from an actual freebsd box with 'openssl speed'; Xeon stats extrapolated from TrueCrypt and OpenSSL benchmarks on E3 series CPUs).
No, because malware kits dont WORK on server installs, they only work when someone browses to your infected website. If you know of any big iron servers running Gnome with an outdated Firefox and a vulnerable version of flash, do let me know, however.
Hacks on servers tend to be bruteforce attempts, worm attacks, and dedicated efforts by a human being. Those are all kind of irrelevant to the discussion, as its a different class of attack than malware.
By the way, if anyone doubts this, I would happily take them up on some challenge with VMs, or physical machines. There could even be some stakes, if you desired, though it wouldnt matter-- neither the CentOS box nor the Windows Server box will EVER be hacked except A) by a bruteforcing of the password (assuming you havent set lockout policies up), or B) by enabling services and allowing traffic through the firewall.
Otherwise, iptables / windows firewall would make any such attempts futile.
Open a zip file in Internet Explorer. Just did that today, and it executed the code.
I open zip-files from browsers of all shades all the time, and it never automatically executes any content. Possibly you have a crappy, bug-ridden archive handler?
Norton didn't complain. I did reveal that it had been rooted, but no prevention.
Add that to the list of problems you need to address-- norton is a pile of garbage, and doesnt reflect well on the state of your computer if you have that installed. It is known to do all sorts of bizarre things. Honestly, its possible that the exploit you experienced-- if legitimate-- was targetted at norton and exploited the way norton performs its scanning.
If you must use an antivirus, use Microsoft Security Essentials-- there are other good free AVs, but MS's is the only one which has been basically trouble-free over the last 2 years (Avast now causes bluescreens, grrrr).
"Since XP SP3, it comes with a deny-all firewall built in" The fire wall fell and the virus walked right around it.
Im going to say this as kindly as I can-- the above comment indicates you dont understand what each of those defenses are for. Viruses often enough do not need to contend with ASLR, DEP, or a firewall, because technically their execution was requested by the user (or at least, content was requested, and said content exploited a plugin flaw).
Each and every year, Mac OSX is exploited before the windows computer in Pwn2Own; its not because Windows is superior, its because most of the OSes share the same types of defense, which still cannot protect against buggy, unsupported 3rd party crapware.
Yes, because windows doesnt have that. Oh wait, it does, its called UAC (GUI) and runas (CLI-- and Ill note that this has been around for absolutely ages).
There IS no "root password" on windows-- as in linux, there are passwords for various accounts with varying privileges. Obviously there is a "default" admin, which is called root on linux / unix, and administrator on windows, but on each system is changeable.
Its like 90% of the people comparing windows to linux have either not used windows, or not used linux. Come on guys, this is basic stuff.
Yes, I dont think I would spend the money if it were that much. But if you can snag a $30 student upgrade, its worth it, and if you are getting a new computer, might as well go for 7. The new GUI is much better (as in, it improves productivity), cross-GPU-vendor multi-monitor is supported, and theres heaps of other goodies. To be sure, there are annoyances, but all in all I think 7 was a good direction.
Now if only they hadnt thrown that all out for the mess that is Windows 8.....
Youre being ridiculous. You cannot address memory in windows as you can through the/dev interface on Linux-- the filesystem paradigm is utterly different. And the two kernel designs are utterly incompatible-- Linux sports a monolithic kernel, while Windows has a microkernel. The binary formats of executable data on each is totally different. Etc etc etc.
Ah, well perhaps you shouldnt have commented on Vista and windows 7. You see, WinXP market share is under 38%, so my comment about "most windows users" was accurate.
Incidentally, 7 really is worth the upgrade-- dont judge it based on Starter which really is awful and is usually put on devices that should never have run windows to begin with.
On all Linux distros, you actually have to type a password to get root status. On Windows, you still only have to click a box to make it go away.
Were that universally true, it would be irrelevant. You nevertheless run as an unprivileged user in Windows 7, and your snarky comment doesnt change that. Until you click allow, the a program may not execute anything with full admin privileges.
As for Linux being "less secure", well, I insist that we measure the incidence of penetrations.
I was hoping to compare privilege escalation bugs or a similar category, Server2008 vs a recent kernel, but its quite tricky A) finding usable lists, and B) comparing a full suite (server2008 standard) to a stripped down linux server install (why not compare to 2008 core?). But I did find this...I see a few Windows hacks on there, and an astonishing number of hacks on things like OpenSSL, SSH, RedHat, etc. Saying hands-down WinServer gets hacked more is ignorant; I would hazard that there is a greater incidence of intrusions on Linux servers than on comparable (year-wise) Windows installs (that is, not comparing kernel 2.6.39 to Windows NT4).
If you are referring to windows malware, that is utterly irrelevant. There is an article on slashdot earlier discussing where malware installs come from, and the upshot is that at LEAST 87% of those installs are technically doable on OSX and Linux-- they exploit cross-platform plugins. And when you look at Pwn2Own, where year after year OSX (a *nix derivative) is the first to fall, it kind of puts a damper on the whole "lol windows security sucks" mentality.
If theres anythign to take from all of this, its that relying on your platform in this day and age for security is brain-dead. All of the major platforms have comparable security features, and all sport built-in firewalls. Vulnerabilities these days overwhelmingly come from 3rd party services (Browser plugins, SSH, OpenSSL, LDAP), not the core OS, and from misconfiguration (including bad passwords). Basically, if anyone starts spouting off about how X infections are because Y operating system sucks, you know that person has absolutely no idea what theyre talking about, and should not be trusted to secure any system.
Sorry but I don't believe that for a second. Because I've actually been down that road with XP. I can lock NT-based Windows down almost as much as any UNIX system is locked down by default. But the problem is that when you really do that, you throw a HUGE pile of software out of the window.
Sorry, but you clearly havent actually used Vista or 7. They dont ask you "would you like to run as least privilege?" in vista / 7; they force you into that. You have to do some tweaks to remove that policy (by turning off UAC).
Why do you think Vista was hated so much? Some of it was performance, but the big user gripe was the "allow or deny" prompts, which were due to dropped privileges.
And you clearly are unaware of all the junction points, registry virtualization, etc that was put into place to make such programs "just work" even without proper privileges-- for example, programs that try to store settings in %programfiles% will usually be redirected to a folder under %appdata%, transparently. Security is kept in tact, the program keeps on working.
Obviously you havent been paying attention to the slow shift towards not requiring admin privileges, which has been going on for about 4 years now.
A), you failed to read my post where I mentioned that 3% of the infections were through Windows Help.
B), the linux marketshare is so absolutely insignificant that you wont be seeing professionally packaged, commercially available (black market) malware kits for linux for a long long time. Macs, on the other hand, are already starting to get their share of them, as their market share is 15-30x higher than Linux's.
Its a hair-splitting distinction. If you can point at a random data blob and tell the system "run the code contained therein", you are running arbitrary code.
Someone didnt pay attention to the Vista and Win7 changes. As in Ubuntu default installs, the user has admin "capabilities", but they are dropped most of the time. To actually use them, you must click through a UAC prompt that is functionally identical to gksudo.
Microsoft.com WAS hacked once, I think it just resulted in a jpg upload though.
However, thats not a fair comparison, given that Microsoft has a huge budget for a dedicated IT team, which makes far more difference in security than the OS you happen to use.
The common wisdom is, our security is superior to Window's security,
And on what do you base that assumption? Because scores of users get pwned by Acrobat and Java exploits, but it just happens to be hitting windows machines?
I have never seen any credible proof that your common Linux server distros (RedHat, CentOS, Debian) are more secure out of the box than Windows Server 2003 or 2008-- and I have seen a LOT to suggest that 2008 (and Win7) are more secure than their *nix counterparts.
I really dont want to start a flamewar on this (though I probably just did), but its ridiculous to continue acting like this is 1995 and Windows is the piece of garbage it once was. Since NT, the filesystem security is better than your most common *nix variants (more granularity, more specificity). Since XP, the system has mechanisms to detect filesystem tampering and to repair it (SFC). Since XP SP3, it comes with a deny-all firewall built in and supports DEP. Since Vista, everyone runs as least-privileged, the browser is sandboxed, the RAM is ASLR'd, the kernel refuses unsigned patches / hooking, and the firewall has been upgraded to something that is on par with iptables. And since 7 x64, all drivers require a digital signature.
A great many of those features came much later in Linux and OSX, and some are STILL lacking (due to fears about centralization, potential for abuse, etc-- valid reasons, but still resulting in lesser security). As it is now, for the most part, there is no appreciable difference between the security of Linux and that of Windows, and I defy anyone to provide a compelling argument to the contrary.
My friends & family run $OS with the browser running in an isolated user account, works quite well
So do most windows users. Luckily for the virus makers, its pretty easy to pester the user with a zillion gksudo / consent.exe prompts requesting elevation-- all it takes is clicking "allow" if you dont have a password set, and its all over.
I assume that for a few reasons. If the exploit relies on being able to stick exe files in dangerous locations where they will be executed by the os (like naming it notepad.exe and sticking it in %windir%), it has several additional issues to deal with-- chiefly, if the user does not have admin credentials, the infection will likely fail.
Having machinecode download and execute code from the %temp% folder is much more reliable, doesnt rely on admin privileges, and is unlikely to be blocked-- if you try to block file execution from temporary folders, it breaks basically every software updater in existence (as they extract to %temp% and then run an extracted exe or msi).
Not correct. You might be able to make the case for "attacks" being a verb, but ONLY if it is referring to a single bear doing the attacking. If it is referring to several incidents, it would be "bear-attack", plural-- that is "bear attacks" (noun).
Dust storm, however, is a noun, and I have never heard the usage that would indicate the dust was storming something-- you would have to think the dust was breaching the walls of something, which is a bit of a stretch.
From the context (being a headline, the use of what appears to be a plural combined with the word "more"), it seems obvious that they are referring to several incidents involving dust storms, and several incidents involving bear attacks.
Slashdot Mirror
This sentiment was expressed on OccupyWallStreet, with one suggestion being a $20/hr min wage, with guarenteed income regardless of work. Both your suggestion and theirs suffer from the same problem: If I do not have to work, why should I work?
More fundamentally, in all of human history, I am unaware of a successful economic system that made work optional for everyone. The reason is once again, if people do not need to work, they do not. There are a million and a half statistics you could look at, showing that once effort and money become decoupled, effort trends towards zero.
Further, if you somehow mandated it, so that 80% of the country literally did nothing, the other 20% would simply leave the country, making that 80% collectively impoverished.
This is really the first time I have EVER heard the protestant work ethic a bad thing, btw. Its generally credited with a number of things, and Wikipedia sort of sums it up as follows:
Hard work and frugality were thought to be two important consequences of being one of the elect; thus, Protestants were attracted to these qualities, seeking to be obedient to God to whom they owed their salvation.
Yes, what an awful thing-- frugality and hard work.
Love the ad hominem, but things arent that simple. I think they absolutely have the legal right to enforce their rights, and our system absolutely must allow them to do so, but I think the way they do it -- as well as their behavior-- reprehensible. It borders on an abuse of the system, and they are highly offensive. I also happen to be baptist, and the fact that they hijack the name and associate us with such nonsense doesnt help.
The problem with disallowing what they do is that it is enshrined in the first amendment-- right to protest, right to assembly, right to free speech. Does their speech offend you? So to does much political speech, and its a short hop from outlawing one type of offensive speech to another. Would the same folks decrying "free speech zones" really defend denying the WBC permission to gather on public property next to a cemetary? Or would they approve of trying to silence them by claiming disturbing the peace, etc? How would we feel if that were applied to us, if we were to demonstrate about something important to us?
This is the heart of the first amendment here, and its been addressed through the ages (neo-nazi marches, flag burning, etc), and thankfully the right of the offensive to be heard has always been upheld, because it is absolutely foundational to a "free country"/
Ive got 8GB RAM, hibernate works just fine, thanks.
More often I use hybrid sleep (not sure if its a windows, or a bios feature), which sleeps for a length of time (say an hour), and if I havent resumed, it wakes up just enough to flush ram to disk.
Means I never have to worry about sleep battery, or waiting for my laptop to finish hibernating.
Im not sure that HTTPS qualifies as "seriously heavyweight". A Pentium4 processor can handle about 400mbit/sec of AES SSL-- lets assume this is the home computer. Rendering the HTML, running scripts, and handling the flash content would comprise a far bigger portion of the CPU usage than perhaps 1meg of SSL'd traffic.
On the server side, you can right now get a $250 Xeon E3 1220L, using ~20watts, which can handle ~13gbit/second of AES traffic (with the AES-NI extensions). If thats not sufficient, you can always get a second one.
Encryption is now very cheap, CPU-wise. (P4 stats taken from an actual freebsd box with 'openssl speed'; Xeon stats extrapolated from TrueCrypt and OpenSSL benchmarks on E3 series CPUs).
Was your first clue the lawsuits they bring against anyone who dares try to silence them? Or perhaps the fact that their pastor is also a lawyer?
No, because malware kits dont WORK on server installs, they only work when someone browses to your infected website. If you know of any big iron servers running Gnome with an outdated Firefox and a vulnerable version of flash, do let me know, however.
Hacks on servers tend to be bruteforce attempts, worm attacks, and dedicated efforts by a human being. Those are all kind of irrelevant to the discussion, as its a different class of attack than malware.
By the way, if anyone doubts this, I would happily take them up on some challenge with VMs, or physical machines. There could even be some stakes, if you desired, though it wouldnt matter-- neither the CentOS box nor the Windows Server box will EVER be hacked except A) by a bruteforcing of the password (assuming you havent set lockout policies up), or B) by enabling services and allowing traffic through the firewall.
Otherwise, iptables / windows firewall would make any such attempts futile.
ow you might say that the Windows machine gets pwned almost immediately because there's more malware out there targeting it,
Actually, the WIndows server will never get owned, because out of the box (at least on SBS installs) the firewall rejects all traffic.
So really, your entire statement falls to pieces.
Open a zip file in Internet Explorer. Just did that today, and it executed the code.
I open zip-files from browsers of all shades all the time, and it never automatically executes any content. Possibly you have a crappy, bug-ridden archive handler?
Norton didn't complain. I did reveal that it had been rooted, but no prevention.
Add that to the list of problems you need to address-- norton is a pile of garbage, and doesnt reflect well on the state of your computer if you have that installed. It is known to do all sorts of bizarre things. Honestly, its possible that the exploit you experienced-- if legitimate-- was targetted at norton and exploited the way norton performs its scanning.
If you must use an antivirus, use Microsoft Security Essentials-- there are other good free AVs, but MS's is the only one which has been basically trouble-free over the last 2 years (Avast now causes bluescreens, grrrr).
"Since XP SP3, it comes with a deny-all firewall built in"
The fire wall fell and the virus walked right around it.
Im going to say this as kindly as I can-- the above comment indicates you dont understand what each of those defenses are for. Viruses often enough do not need to contend with ASLR, DEP, or a firewall, because technically their execution was requested by the user (or at least, content was requested, and said content exploited a plugin flaw).
Each and every year, Mac OSX is exploited before the windows computer in Pwn2Own; its not because Windows is superior, its because most of the OSes share the same types of defense, which still cannot protect against buggy, unsupported 3rd party crapware.
Yes, because windows doesnt have that. Oh wait, it does, its called UAC (GUI) and runas (CLI-- and Ill note that this has been around for absolutely ages).
There IS no "root password" on windows-- as in linux, there are passwords for various accounts with varying privileges. Obviously there is a "default" admin, which is called root on linux / unix, and administrator on windows, but on each system is changeable.
Its like 90% of the people comparing windows to linux have either not used windows, or not used linux. Come on guys, this is basic stuff.
Yes, I dont think I would spend the money if it were that much. But if you can snag a $30 student upgrade, its worth it, and if you are getting a new computer, might as well go for 7. The new GUI is much better (as in, it improves productivity), cross-GPU-vendor multi-monitor is supported, and theres heaps of other goodies. To be sure, there are annoyances, but all in all I think 7 was a good direction.
Now if only they hadnt thrown that all out for the mess that is Windows 8.....
Or am-I just being paranoid ?
Youre being ridiculous. You cannot address memory in windows as you can through the /dev interface on Linux-- the filesystem paradigm is utterly different. And the two kernel designs are utterly incompatible-- Linux sports a monolithic kernel, while Windows has a microkernel. The binary formats of executable data on each is totally different. Etc etc etc.
Or am I just being trolled?
Ah, well perhaps you shouldnt have commented on Vista and windows 7. You see, WinXP market share is under 38%, so my comment about "most windows users" was accurate.
Incidentally, 7 really is worth the upgrade-- dont judge it based on Starter which really is awful and is usually put on devices that should never have run windows to begin with.
On all Linux distros, you actually have to type a password to get root status. On Windows, you still only have to click a box to make it go away.
Were that universally true, it would be irrelevant. You nevertheless run as an unprivileged user in Windows 7, and your snarky comment doesnt change that. Until you click allow, the a program may not execute anything with full admin privileges.
As for Linux being "less secure", well, I insist that we measure the incidence of penetrations.
I was hoping to compare privilege escalation bugs or a similar category, Server2008 vs a recent kernel, but its quite tricky A) finding usable lists, and B) comparing a full suite (server2008 standard) to a stripped down linux server install (why not compare to 2008 core?).
But I did find this...I see a few Windows hacks on there, and an astonishing number of hacks on things like OpenSSL, SSH, RedHat, etc. Saying hands-down WinServer gets hacked more is ignorant; I would hazard that there is a greater incidence of intrusions on Linux servers than on comparable (year-wise) Windows installs (that is, not comparing kernel 2.6.39 to Windows NT4).
If you are referring to windows malware, that is utterly irrelevant. There is an article on slashdot earlier discussing where malware installs come from, and the upshot is that at LEAST 87% of those installs are technically doable on OSX and Linux-- they exploit cross-platform plugins. And when you look at Pwn2Own, where year after year OSX (a *nix derivative) is the first to fall, it kind of puts a damper on the whole "lol windows security sucks" mentality.
If theres anythign to take from all of this, its that relying on your platform in this day and age for security is brain-dead. All of the major platforms have comparable security features, and all sport built-in firewalls. Vulnerabilities these days overwhelmingly come from 3rd party services (Browser plugins, SSH, OpenSSL, LDAP), not the core OS, and from misconfiguration (including bad passwords). Basically, if anyone starts spouting off about how X infections are because Y operating system sucks, you know that person has absolutely no idea what theyre talking about, and should not be trusted to secure any system.
Sorry but I don't believe that for a second. Because I've actually been down that road with XP. I can lock NT-based Windows down almost as much as any UNIX system is locked down by default. But the problem is that when you really do that, you throw a HUGE pile of software out of the window.
Sorry, but you clearly havent actually used Vista or 7. They dont ask you "would you like to run as least privilege?" in vista / 7; they force you into that. You have to do some tweaks to remove that policy (by turning off UAC).
Why do you think Vista was hated so much? Some of it was performance, but the big user gripe was the "allow or deny" prompts, which were due to dropped privileges.
And you clearly are unaware of all the junction points, registry virtualization, etc that was put into place to make such programs "just work" even without proper privileges-- for example, programs that try to store settings in %programfiles% will usually be redirected to a folder under %appdata%, transparently. Security is kept in tact, the program keeps on working.
Obviously you havent been paying attention to the slow shift towards not requiring admin privileges, which has been going on for about 4 years now.
Thanks for linking that page, it is a brilliant piece of troll-work. I would like my $20/hr min wage for doing nothing now, please.
Im fairly certain you can bypass that-- either through an "about:" page or through a command-line switch.
A), you failed to read my post where I mentioned that 3% of the infections were through Windows Help.
B), the linux marketshare is so absolutely insignificant that you wont be seeing professionally packaged, commercially available (black market) malware kits for linux for a long long time. Macs, on the other hand, are already starting to get their share of them, as their market share is 15-30x higher than Linux's.
Its a hair-splitting distinction. If you can point at a random data blob and tell the system "run the code contained therein", you are running arbitrary code.
Someone didnt pay attention to the Vista and Win7 changes. As in Ubuntu default installs, the user has admin "capabilities", but they are dropped most of the time. To actually use them, you must click through a UAC prompt that is functionally identical to gksudo.
Microsoft.com WAS hacked once, I think it just resulted in a jpg upload though.
However, thats not a fair comparison, given that Microsoft has a huge budget for a dedicated IT team, which makes far more difference in security than the OS you happen to use.
The common wisdom is, our security is superior to Window's security,
And on what do you base that assumption? Because scores of users get pwned by Acrobat and Java exploits, but it just happens to be hitting windows machines?
I have never seen any credible proof that your common Linux server distros (RedHat, CentOS, Debian) are more secure out of the box than Windows Server 2003 or 2008-- and I have seen a LOT to suggest that 2008 (and Win7) are more secure than their *nix counterparts.
I really dont want to start a flamewar on this (though I probably just did), but its ridiculous to continue acting like this is 1995 and Windows is the piece of garbage it once was. Since NT, the filesystem security is better than your most common *nix variants (more granularity, more specificity). Since XP, the system has mechanisms to detect filesystem tampering and to repair it (SFC). Since XP SP3, it comes with a deny-all firewall built in and supports DEP. Since Vista, everyone runs as least-privileged, the browser is sandboxed, the RAM is ASLR'd, the kernel refuses unsigned patches / hooking, and the firewall has been upgraded to something that is on par with iptables. And since 7 x64, all drivers require a digital signature.
A great many of those features came much later in Linux and OSX, and some are STILL lacking (due to fears about centralization, potential for abuse, etc-- valid reasons, but still resulting in lesser security). As it is now, for the most part, there is no appreciable difference between the security of Linux and that of Windows, and I defy anyone to provide a compelling argument to the contrary.
My friends & family run $OS with the browser running in an isolated user account, works quite well
So do most windows users. Luckily for the virus makers, its pretty easy to pester the user with a zillion gksudo / consent.exe prompts requesting elevation-- all it takes is clicking "allow" if you dont have a password set, and its all over.
I assume that for a few reasons. If the exploit relies on being able to stick exe files in dangerous locations where they will be executed by the os (like naming it notepad.exe and sticking it in %windir%), it has several additional issues to deal with-- chiefly, if the user does not have admin credentials, the infection will likely fail.
Having machinecode download and execute code from the %temp% folder is much more reliable, doesnt rely on admin privileges, and is unlikely to be blocked-- if you try to block file execution from temporary folders, it breaks basically every software updater in existence (as they extract to %temp% and then run an extracted exe or msi).
Not correct. You might be able to make the case for "attacks" being a verb, but ONLY if it is referring to a single bear doing the attacking. If it is referring to several incidents, it would be "bear-attack", plural-- that is "bear attacks" (noun).
Dust storm, however, is a noun, and I have never heard the usage that would indicate the dust was storming something-- you would have to think the dust was breaching the walls of something, which is a bit of a stretch.
From the context (being a headline, the use of what appears to be a plural combined with the word "more"), it seems obvious that they are referring to several incidents involving dust storms, and several incidents involving bear attacks.