> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Does it work though? What evidence supports this claim? I use Windows

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Does it work though? What evidence supports this claim? I use Windows with no AV and I've been having no problems. Mainly because I don't install software from shady sources. But I know people who install pirated software, because they can't afford it (a common situation for e.g. architecture students), or pirated games and use an AV and after some time their computers become universally unusable, because of course they got a load of malware. AVs do not protect them. Builtin security mechanisms in Windows (such as UAC) bring a lot more benefit to me than AVs bring to those who pirate software. > Considering the number of breaches of NPM/Rubt repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them. People obviously are doing something. Effort is going into Wayland, we continue getting new Linux namespaces in new kernels, firejail is under continued development, some people rewrite their apps from C to Go and Rust (newsboat, coreutils for Debian recently), even more of them gets written in one of those languages, when started from scratch. It may be that things are moving a bit slow, but such is life in FOSS. NPM doesn't have anything to do with Linux Desktop. If Linux Desktop relied on NPM for security, it would be obviously broken (since distributing software any other way would sidestep NPM mitigations). > You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety. Again, I would like to hear what exactly a Linux AV would do. Just compare file checksums against a db? What system APIs would it use? How is an "antivirus" superior to a sandbox? How would it be able to prevent Xorg keyloggers? How would we audit it? > Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop. It is exactly what you can do with firejail. The issue with Xorg and firejail is that there is a socket to the outside world that needs to be available in the sandbox for any X apps to work, and then all Xorg issues are available. But that's a flaw of Xorg, not firejail. > AV vendors have a reputation to keep. Just like Apple has a privacy reputation to keep, yet doesn't provide end-to-end encryption for the data which is sent to iCloud. They still get to be "champions of privacy". Just like Zoom has a reputation to keep and had a major issue in that regard as well. If it is proprietary, then I have less of a reason to trust it, not more because of a "reputation". > That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel. The way to protect against malicious code in the kernel is to move as much code out of the kernel as possible. I certainly don't feel more secure by having more proprietary code run with elevated privileges. Overall, if Linux security issues cannot be solved systematically, then I really doubt they could be solved with an antivirus. A better bet at that point would be ditching Linux for something else. (In the future maybe some operating systems will be built on seL4, which is promising.)