5 ms·

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece of software that protects the computer against viruses". How does it do that? The idea that to fix a security issue you should install an additional program which "increases" security is dubious. The problems listed on the page are real and we should tackle them. However, I don't think that an "antivirus" is the right solution. Instead security should be treated in a systematic way, not something that you add to a system, after it's done. I think we should invest in, among others, sandboxing techniques, move away from Xorg, write system software in memory-safe languages. Security is not an app to be installed. It's an architectural problem. It's also ironic that most of the points listed on the page apply equally well to antivirus software. Namely, are distro maintainers qualified to verify antivirus code? What if an antivirus gets compromised? An open source antivirus could also get code submissions with cleverly hidden backdoors. And what if it's proprietary? (Most of them are.) They also commonly run with elevated privileges (the point about sudo).

itvision 6y ago
> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them. > Instead security should be treated in a systematic way As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety. > Security is not an app to be installed. It's an architectural problem. Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop. > Namely, are distro maintainers qualified to verify antivirus code? AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands). > They also commonly run with elevated privileges (the point about sudo). That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.
- matkoniecz 6y ago
  > For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.
  - Causalityl 6y ago
    Avast itself recently became malware and got its extensions pulled. Another reason for architectural security is that every third party program capable of updating itself has one unfixable vulnerability: the almighty dollar. A company gets bought out or an individual gets bribed and suddenly a stranger's in your house.
  - itvision 6y ago
    My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.
    - matkoniecz 6y ago
      Well, 2020 was not a year of Linux of desktop. How many people use Linux AND fail to notice obvious signs AND download malware/viruses common enough to be detected by antiviruses?
    - sliken 6y ago
      Did they download a random anti-virus program from the net? Which ones are the secure ones? How did they know it was avoided? Did a popup from the software they installed tell them so?
      - itvision 6y ago
        Noticed a popup "Malware has been disinfected" and the bad files were automatically moved to a quarantine. Don't remember the AV which was used.
ssivark 6y ago
That’s a good point — even in the more limited sense of security today, the null hypothesis to be compared against is a regularly updated system. I wonder if there are any viruses/exploits which are known (so that antivirus software can detect it) but unpatched/unpatchable so regular (security) updates are not good enough.
sliken 6y ago
Agreed, anti-virus runs with elevated privileges, and downloads rules/code from a central source. So any compromise in the anti-virus client or the server it downloads from can cause serious security issues. There's been numerous reports of bugs, exploits, and really stupid behavior like man in the middle attacking all certs, and "forgetting" to check if the certs were valid. Similarly false positives can cripple a machine. Some anti-virus companies even put malicious entries into the anti-virus databases to try to trick the competition from banning clean files. So there is a security cost, CPU cost, memory cost, I/O cost, and reliability costs. It's far from clear that anti-virus makes sense on any platform. Sure the major vendors are pushing FUD to keep the income stream going. Obviously compromising an anti-virus company would be huge win for an attacker, so it shouldn't be a surprise they are common targets, in particular NSA and GCHQ have both targeted anti-virus companies. In my experience users of OSX and Windows have MUCH less functionality out of the box and need MUCH more of the dreaded google for software and download from a random site, thus the higher need for anti-virus.

itvision 6y ago

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them. > Instead security should be treated in a systematic way As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety. > Security is not an app to be installed. It's an architectural problem. Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop. > Namely, are distro maintainers qualified to verify antivirus code? AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands). > They also commonly run with elevated privileges (the point about sudo). That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

matkoniecz 6y ago
> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.
- Causalityl 6y ago
  Avast itself recently became malware and got its extensions pulled. Another reason for architectural security is that every third party program capable of updating itself has one unfixable vulnerability: the almighty dollar. A company gets bought out or an individual gets bribed and suddenly a stranger's in your house.
- itvision 6y ago
  My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.
  - matkoniecz 6y ago
    Well, 2020 was not a year of Linux of desktop. How many people use Linux AND fail to notice obvious signs AND download malware/viruses common enough to be detected by antiviruses?
  - sliken 6y ago
    Did they download a random anti-virus program from the net? Which ones are the secure ones? How did they know it was avoided? Did a popup from the software they installed tell them so?
    - itvision 6y ago
      Noticed a popup "Malware has been disinfected" and the bad files were automatically moved to a quarantine. Don't remember the AV which was used.

ssivark 6y ago

That’s a good point — even in the more limited sense of security today, the null hypothesis to be compared against is a regularly updated system. I wonder if there are any viruses/exploits which are known (so that antivirus software can detect it) but unpatched/unpatchable so regular (security) updates are not good enough.

sliken 6y ago

Agreed, anti-virus runs with elevated privileges, and downloads rules/code from a central source. So any compromise in the anti-virus client or the server it downloads from can cause serious security issues. There's been numerous reports of bugs, exploits, and really stupid behavior like man in the middle attacking all certs, and "forgetting" to check if the certs were valid. Similarly false positives can cripple a machine. Some anti-virus companies even put malicious entries into the anti-virus databases to try to trick the competition from banning clean files. So there is a security cost, CPU cost, memory cost, I/O cost, and reliability costs. It's far from clear that anti-virus makes sense on any platform. Sure the major vendors are pushing FUD to keep the income stream going. Obviously compromising an anti-virus company would be huge win for an attacker, so it shouldn't be a surprise they are common targets, in particular NSA and GCHQ have both targeted anti-virus companies. In my experience users of OSX and Windows have MUCH less functionality out of the box and need MUCH more of the dreaded google for software and download from a random site, thus the higher need for anti-virus.