That's true, but it only matters once the attacker manages to run code - which is significantly harder to achieve on Linux, due to diversity (opposite of win mo

That's true, but it only matters once the attacker manages to run code - which is significantly harder to achieve on Linux, due to diversity (opposite of win monoculture) and mostly sane defaults (no local directory in executable or dll search directory; file name not enough for execute permission). Buffer overflows and targeted attacks are comparable in ease, but if you are not targeted, you are way safer on Linux.