3 ms·

It’s pretty amazing that after all these years there is so little malware on Linux and in foss. The community really has somehow remained almost completely trus

It’s pretty amazing that after all these years there is so little malware on Linux and in foss. The community really has somehow remained almost completely trustworthy. I don’t know of many other examples of that. Nobody trusts free as in beer software, but if it’s open source, we have barely had to even think about whether it’s safe or not because it has almost always been so - even tiny one-maintainer projects

indymike 6y ago
After dealing with hosting websites for paying customers on shared servers I'm not so sure that you can assume Linux is free of being targeted. Linux the OS may not be targeted, but Linux software like WordPress (and many others) is under constant attack. What is interesting is that the payload the hacker is trying to deliver often is not a rootkit - a bot node can run just fine as a user process on a Linux (or BSD) server. I've had to clean up: evil javascript injected into content, control servers for botnets, email relays, phishing farm software, chat servers and one time a whole CRM system. The one thing that was nice in every case was that Linux did a great job of isolating the hack to a single user's files.
- samus 6y ago
  Linux would be targeted for sure if the exploits were easier to pull of. Because then the things you just described could be done to all the users on the system simultaneously.
nemothekid 6y ago
>It’s pretty amazing that after all these years there is so little malware on Linux and in foss. There's plenty of malware in Linux; it's just never called malware. I'm generally more wary of installing random software on a Linux box than I am on my personal macOS machine. When I ssh into a customer's machine to discover a bitcoin miner that is definition of malware; and there have been plenty of exploits that involve shodan style scans that take advantage of server software with poor defaults.

indymike 6y ago

After dealing with hosting websites for paying customers on shared servers I'm not so sure that you can assume Linux is free of being targeted. Linux the OS may not be targeted, but Linux software like WordPress (and many others) is under constant attack. What is interesting is that the payload the hacker is trying to deliver often is not a rootkit - a bot node can run just fine as a user process on a Linux (or BSD) server. I've had to clean up: evil javascript injected into content, control servers for botnets, email relays, phishing farm software, chat servers and one time a whole CRM system. The one thing that was nice in every case was that Linux did a great job of isolating the hack to a single user's files.

samus 6y ago
Linux would be targeted for sure if the exploits were easier to pull of. Because then the things you just described could be done to all the users on the system simultaneously.

nemothekid 6y ago

>It’s pretty amazing that after all these years there is so little malware on Linux and in foss. There's plenty of malware in Linux; it's just never called malware. I'm generally more wary of installing random software on a Linux box than I am on my personal macOS machine. When I ssh into a customer's machine to discover a bitcoin miner that is definition of malware; and there have been plenty of exploits that involve shodan style scans that take advantage of server software with poor defaults.