Don't let a security emergency go to waste

I shitposted about this on Mastodon earlier, but seriously, I think this is a unique opportunity where multiple internet security incidents have escaped containment and gone mainstream. Our non-tech friends and family are paying attention and may just be motivated enough to take basic digital security steps that at least I have been recommending for years.

When my friends proactively asked me what they should be doing, I put together the following list:

1. Update all of your devices, reboot, and enable auto-updates where possible.
   Rationale: the eMudhra TLS certificate compromise may require system updates for the certificate store, and enabling automatic updates is a best practice for most users.
2. Install an ad blocker in your browser, specifically uBlock Origin or uBO Lite.
   Rationale: last week Citizen Lab revealed zero-click spyware distributed through targeted ads. Despite the name, ad blockers are effective at blocking tracking and malware.
3. Avoid online shopping for the next few days just to let things settle down (i.e. touch grass).
   Rationale: a number of online retailers use PHP, so waiting a few days gives everyone time to patch against PHP2Shell, brotli, and everything else that came out this past week.

I think three items is good enough, but if I were to add a fourth, it would be to start using Signal as its encryption does not rely on the integrity of certificate authorities.

Feel free to share my list and/or come up with your own.