Or maybe instead of educating the users we should be educating the criminals so they can get paid to work on more productive things. Lots of solutions here.

While this is a potentially good idea to do in parallel, it is effectively impossible to reduce crime rate to literally zero, and the nature of the internet means that users can receive the same volume of malicious emails/ads and other malware vectors with fewer actors.

I like the basic idea, but at least if educating is to be understood as imparting trade knowledge and/or skills I seriously doubt if that particular deficit is what keeping most of those people off the straight and narrow.

Then you, like most of society, don't understand what drives criminal behaviour.

Many professional criminals do so out of lack of other options. Others are expressing antisocial sentiment, often a result of trauma or feeling rejected by society. In my case, it was a mixture of both.

Anyone that tells you that a complex societal problem is solely the result of moral failing or "bad people" does not have a good understanding of the problem space.

NB- I'm on the straight and narrow these days :)

Nobody mentioned anything about them having morale failures. The point was that if they are making money by writing malware, then lack of education or training isn't why they're doing it, because they're clearly qualified to do at least entry level computer work. Whether or not that work is available, or pays enough, is another story.

Thus the appeal of walled gardens. The user can’t run malware if they can’t install any off app store software by default. Linux repositories are an earlier example. The current Windows ecosystem of the first search result being malware, downloading often unsigned .exe files and conditioning users to click next until they get what they want is a mess.

Playstore is a walled garden. And this article is a wolf cry exactly against malware from Playstore. In the end same social engineer techniques employed to trick people to install malware directly (see Windows) can be employed to trick the walled garden gatekeepers to allow malware there.

I would argue that having walled garden is actually worse. Once malware is inside can wreck havoc far greater than the open system of Windows. Sure, you get fewer bad actors inside but those who do manage to get inside will be fully free because of the false security its users feel.

That "airtight door" phrase of his has always irked me very much. The audacity, when a new air leak springs about every fortnight.

Yep, air leaks do happen. Not his fault though, but his blog is a gold mine of information, definitely top 5 to read religiously every day, don't you agree?

The idea that a single user can outsmart thousands of motivated professional criminals with powerful computers is a complete nonstarter.

"Don't trust anything on internet"

"Don't click on links you don't trust"

See? 2 simple rules, that's all it takes.

So you shouldn't trust the new york times or other major websites that have served malicious javascript?

That advice didn't work in the 90s let alone nowadays