So what isn't a security risk?

Well, welcome to the United

Well, welcome to the United States of Amnesia, where it didn't happen if it wasn't in this week's news.

Why is it humans dismiss warnings if they have yet to witness the (potential) problems in action?

Sure, only a subset of the current warnings are for things that will flare up into big problems in the shortterm, but haven't you seen enough (typically initially dismissed) warnings prove valid so that you'll stop declaring them useless?

I claim you don't have the data to say there aren't wireless attacks that are significant. Just how is it you know what is going on these days? Successful exploits don't announce themselves. In fact, we're lucky to detect them. Oh, sorry the last news story demonstrating this fact is a few weeks old.

I wouldn't be surprised if one could make some nice extra cash by driving about to locate vulnerable systems, turn them into zombies then (or at some later time) and then selling/renting the zombies to a SPAMming operation.

Sound like a hassle? Wireless is probably the easiest way onto a home network at this point, and we all know access is required before cracking a system is possible. Organized crime is recruiting mules via the internet for money laundering, why wouldn't they recruit war-drivers for related criminal purposes?

BTW, Did you miss the Intel wireless driver screwup? Do you think the endless chain of these kinds of vendor screwups is going to end anytime soon? Do you think that the existence of a patch makes the vulnerability go away?

Do you think that because you can't see a way to exploit a situation youself that an exploit isn't possible? The wierd stuff that goes on these days should be ample proof of the flaw of that way of thinking. Exploits aren't usually implemented by using the systems as intended, and that's where your head is - use as intended.

As an exersize for the reader, review the rise and fall of the various wireless security "solutions." Have we ever gone more than 6 months with a wireless security solution standing up as billed by the vendors and IEEE? It's not just the cybervandals and crooks that are fueling this fire. The IEEE let a classically flawed cryptographic implemention into one of their standards. This, after bragging how crypto experts were consulted on the standard.

Stop kidding yourself. With computers, it's always something and we're a long way from it being hard to compromise some types of systems. Get with the program and at least help reduce the problem by advising folks to tighten up on access to their chunk of the Internet.

Sound off on the lack of egress filtering by many AP/router vendors too, if you want to make a positive contribution.

It's "defense in depth" if you want to be current in your mindset...