7 ms·
Poll: Do you use anti-virus software on desktop Linux?
- timemachine 4y agoIf you work for a company that has cybersecurity insurance, they ask, point-blank, if all employee desktops have antivirus before they quote your premium. You just have to use it. It’s not a subject for religious dogma.
- mattl 4y agoClamav is the only anti virus I know of for Linux
- OJFord 4y agoIt's all I've heard of too - though I suppose you run it in wine or a container, or even a traditional VM for that matter (just limited to scanning the mounted volume, not processes etc.) - I just wanted to keep it open and didn't think there was any point splitting the 'yes' vote.
- verdverm 4y agoClamAV runs natively in linux. AV typically hashes files and matches them against a known database. It's not doing something that is only possible in windows
- frankharv 4y agoIt also looks inside files complimenting my FreeBSD desktop. PDF's for example can embed JavaScript. Clam alerts to those with malicious payload. I am sure there are false positives but I don't want anything embedded in my PDF's. I use xPDF reader and feel relatively safe. It does only the bare basic. Nevertheless I like knowing whats lurking inside my PDF's on my disk. Deleting any PDF with embedded JS is fine with me. For that I salute you ClamAV.
- OJFord 4y agoI know, I was saying you could, I suppose, run Avast or McAfee or whatever in those ways.
- verdverm 4y agoRecently hit v1 too
- nostromo177 4y ago[dead]
- version_five 4y agoNaive question: Is there information about how viruses and anti-viruses work? I have various linux servers (which seem not to be the point of this discussion) and a linux laptop machine I use almost exclusively for development. I worry about supply chain attacks (I do machine learning development in python and there have been various recent examples of package repositories having malicious content inserted.) Would any antivirus help with that? What else do I need to be worried about using linux?
- verdverm 4y agoClamAV can detect programs that take part in DDoS attacks. The program did not attack the VM, just used it as part of a botnet
- markhahn 4y agoML is pretty promiscuous (as are some other ecosystems), so supply-chain is a realistic threat to a developer. restricting the user that runs such code is helpful. but suppose it gets owned: - can it call home? - can it escalate to root? the latter might be via a local kernel compromise, but that's challenging if calling home is hard. otoh, sudo is often installed...
- verdverm 4y agoClamAV, worth running, it doesn't use many resources. Linux is popular enough now that it is an attractive target, especially with all the cloud vms running out there If you run it behind a NAT, you'll need to run an internal virus database server. They rate limit downloads per IP. So fetch theirs once per day, serve as much as you want internally.
- mixmastamyk 4y agoWhat does more harm than good mean? What harm could there be but a slower machine?
- ender341341 4y agoI mean there's several AV's on windows that make you massively more vulnerable to attack in really stupid ways (like injecting laughably exploitable code into browsers)
- FrostKiwi 4y agoOver reliance and security holes. Two issues that have been pit falls on windows. The user puts too much trust in said AV system, not understanding its limits and capabilities, subsequently stopping doing his own due diligence in the vast depths of the net. Also, historically AV programs were used to breach systems. They usually enjoy a high level of access, but the team behind these programs isn't magically bigger than any other piece of software. As such a target for attackers, who study the AV software to circumvent it and as a result, may stumble one ways to use it as an attack vector.
- daurnimator 4y agoe.g. some anti-virus software requires a kernel module; this adds additional attack surface e.g. historically anti-virus engines have had bugs where e.g. when they search inside of a .zip file; their .zip parser was susceptible to a buffer overflow that would have allowed a malicious file when scanned to run arbitrary code. e.g. some anti-virus software has a daemon that runs on localhost with an exposed port. This port receives RPCs. websites in your browser have been able to make requests to the anti-virus daemon.
- sliken 4y agoAntivirus consumes money, staff time, CPU resources, disk I/O, etc. You can have false positives and false negatives, which can cause even more problems and train people to ignore whatever the antivirus says. The antivirus can cause security problems as well, things like man in the middle proxies to scan HTTPS traffic, but they "forget" to check the certificates, which handily disables the entire point of HTTPS. Basically it's makes security worse, and consumes resources that would be better used elsewhere, like say with a whitelist.
- ergonaught 4y agoI don’t even use it in Windows.
- bragr 4y agoUnless you've specifically disable Defender, you're using it.
- KingMachiavelli 4y agoThe big issue I had with ClamAV is that the entire virus definitions database has to be kept in memory which is significant on VMs with only 1 or 2GB of memory. Maybe there's away to limit the definitions to only Linux malware since IIRC the majority of the ClamAV database are for Windows viruses/malware.
- rom-antics 4y agoI don't use it on any OS. There was a dark age of plentiful zero-days when it made sense to use antivirus (I suppose), but these days as a technical user you're pretty safe if you run an adblocker and don't download random binaries.
- EMM_386 4y ago> I don't use it on any OS You don't even leave the built-in Windows Security (or Defender) running on Windows? I haven't noticed any performance impact or false positives in the years it's been running, and it is supposed to be highly effective. Better safe than sorry I guess. Although I have never had a virus in 30+ years.
- arp242 4y ago> You don't even leave the built-in Windows Security (or Defender) running on Windows? Is there even an option to disable it? I disabled what I could on my VM and it still eats up all my CPU and memory (I should maybe get a faster laptop, but it works fine for everything except this, and I only rarely need it to test something).
- zx8080 4y ago+1 I would love to know too how to disable it completely.
- hsbauauvhabzb 4y agoAdding c:/ in the whitelist is your best bet. I strongly advise against it unless you’re doing malware research though.
- rdlw 4y agoWinAero Tweaker can disable it.
- dTal 4y ago"Lisa, I want to buy your rock."
- djs070 4y agoWould love to hear from the "I don't think we need it on Linux" folks. What is it about antivirus that we don't need? Is it the wrong solution to securing a workstation?
- bluedino 4y agoNever had linux antivirus do anything other than flag Windows viruses
- megalottachoc 4y agoLoL that made my day XD
- marcodiego 4y agoMost software used comes from repositories. Most of the time the user is not logged in as root. Any virus would have to exploit a system vulnerability, if that is common and serious enough to cause harm then anti-virus software will take longer to catch than it will take to be automatically fixed by updates.
- charcircuit 4y ago>Most of the time the user is not logged in as root Why does this matter? Most malicious things someone would want to do don't require root. eg. VNC, DDoS, mic / webcam capture, token stealing, keylogging, ransomeware, stealing ssh / pgp keys, adware, backdoored web browsers. And for the small percentage that do you can just backdoor sudo or make a fake system update dialog that captures the user's password to let you have root whenever you want.
- markhahn 4y agoit's fairly easy to resist lateral movement in Linux...
- paranoidrobot 4y ago> Any virus would have to exploit a system vulnerability, I'm not sure if by virus you mean some specific definition, but malware can still result in a very long and painful day/week/whatever with just access to your home directory and nothing else. What would happen if your ~/.aws folder was piped to pastebin? Even if you're using short-lived STS sessions with ephemeral keys, I imagine most people would still find themselves in a world of hurt. How about sending interesting files from your browser's userdata directory? All your cookies, your browser's password manager, possibly copies of your third-party password manager's cache (even if it's all encrypted), copies of cached files, your Downloads directory.
- oneplane 4y agoSo far, most classic AV systems are either so bad you're better off with nothing or they are not advanced enough to do much (and thus they're not really helping with anything). It's not that there is no need, it's just that there is no realistic scenario where what's available and what it needs to solve match up.
- GuB-42 4y agoYes, we use ClamAV at work. The reason is maybe the least satisfying of all. Because there is a rule somewhere saying that all workstations have to have an antivirus, Linux or Windows, same rules. Since "apt install clamav" is easier than arguing against the rulemakers again, that's what we did. And it is also not completely stupid, Linux viruses exist, and detecting malware on unaffected system is good too, because chances are that uncaught files will end up on vulnerable systems later. But really, the main reason we installed an antivirus to comply with some corporate rules.
- wanderingmind 4y agoAh yes, the pleasures of getting ISO certification.
- bragr 4y agoI've seen clamav used for PCI compliance too. Probably a lot of certifications that have some "security" component.
- httgp 4y agoSOC-2 requires that you run an antivirus too.
- Ao7bei3s 4y agoNo, it doesn't. It's very important to distinguish between what is actually required for compliance, and what is being done in the name of compliance, and make sure that "compliance" isn't just abused to shut down discussions easily. SOC2 does not have any criteria specifically requiring antivirus software. The actual requirements are more generic; for example CC6.8: "controls to prevent or detect and act upon the introduction of unauthorized or malicious software". That doesn't even sound like an unreasonable requirement to me. If your company reads "no computer without antivirus" into that, that's on your company (and what they put in their SOC2 Type 1). Of course AV manufacturers will gladly agree that it should be read that way, and auditors will be more familiar with that approach. But if you can achieve the same in a different way, that's ok too - you just have to write it down that way. And the auditors can be reasoned with - their focus is anyway more to verify that you can show evidence (e.g. screenshots) of actually doing what you wrote down.
- flatiron 4y agoI don’t. I guess I blindly trust the packages in arch and ready the pkgbuilds in aur. Never found and virus issues.
- tkuraku 4y agoAt work we have to run Microsoft defender on Linux. Seems pretty good. I don't even notice it.
- hutzlibu 4y agoHuh? You mean you install windows defender on linux, or you perform scans with defender from windows on the linux partitions? Was this irony, or has the world become even weirder?
- hahalolha 4y ago> Was this irony, or has the world become even weirder? Nope, it's definitely the latter. Microsoft released a version of Defender for multiple platforms including: MacOS, Linux, Android and iOS. IIRC there's personal and enterprise editions both linked to 365 through "Microsoft 365 Defender". I really can't imagine it doing much especially on iOS, it's there for the security checkbox/policy I guess. Sources: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/non-windows https://learn.microsoft.com/en-us/microsoft-365/security/def... https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender https://learn.microsoft.com/en-us/microsoft-365/security/def...
- frankharv 4y agoClamAV/FreshClam/U-block Origin/SeaMonkey/XFCE4/FreeBSD I like that deep dive Clam gives you inside files. Finds lots of PDF's with JS. Naughty little kiddies.
- webkike 4y agoIf you're in a situation where you need to use antivirus on linux I'd assume you're already owned
- hsbauauvhabzb 4y agoLet me introduce you to a security topic called ‘compliance’.
- webkike 4y agoowned by the man
- Ao7bei3s 4y agoLinux desktop users are so trusty; the only reason half of them aren't owned yet is because they aren't being targeted. Groups doing Windows malware are routinely doing things like reverse engineering vulnerabilities from binary diffs within hours of Microsoft releasing a patch. If they would spend even a fraction of the skill and effort on targeting Linux desktop users, plenty of Linux users would be owned fast. And unlike with Windows, the Linux community as a whole hasn't spent years evolving ways to respond to this quickly (with the notable exception of _offering_ security updates to address vulnerabilities quickly... through some channels and not others, and many users update twice a year at best). How much software from hundreds of third-party repos (e.g. AUR) and third-party package managers (e.g. pip) do devs use? Taking over an abandoned package (maybe a dependency of a more popular package), or worse actually legitimately maintaining a package for half a year before adding the malware, isn't hard. And once the malware is on the computer, there are few safeguards for the actual data (malware can probably encrypt $HOME or exfiltrate ~/.ssh/*). The Linux ecosystem is more than the kernel; it's everything other than the kernel that needs hardening. Especially the culture; the "it can't happen to us" attitude needs to go.
- webkike 4y ago> Linux desktop users are so trusty; the only reason half of them aren't owned yet is because they aren't being targeted. And the other half have ClamAV? Why _wouldn't_ they be targeted, surely a large number of proprietary technologies are developed on linux
- 1970-01-01 4y agoA bit better of a question would be "Yes, it's stopped malware from running." Has anyone ever caught a thing with it running? It's exclusively a checkbox item for security. Does nothing but take up RAM. Tell me otherwise.
- nextos 4y agoI think what we really need on Linux is: * A better application firewall (like Little Snitch for macOS, OpenSnitch looks promising) * Sandboxing by default (falling a bit behind macOS, bubblewrap is a good solution) * Better package management (Nix is SOTA, but we need better tools to monitor upstream against malicious commits) * Better monitoring tools (that take advantage of eBPF and report suspicious activity)
- bediger4000 4y agoWhy do you want an application firewall? I thought the reason folks ran those on Windows was because of proprietary, must-have software that opened ports with mysterious purposes that unresponsive vendors wouldn't explain or close.
- nextos 4y agoLittle Snitch is designed to protect you by limiting outbound traffic. The idea is to block all traffic and approve or deny application connections the first time they happen by creating rules. Imagine you are running a compromised package installed with e.g. pip. This could provide a last line of defense when it tries to steal your data, if it's not supposed to make certain connections.
- dhaavi 4y agoWe are developing the Portmaster Application Firewall that has a couple nice privacy and security features, including network monitoring. Open Source. Linux & Windows. Android in progress. https://safing.io/ https://safing.io/ If you check it out, we'd love feedback!
- kaba0 4y agoNot sure how good bubblewrap is, to my knowledge it only refuses unprivileged actions and doesn’t really have a way of “negotiation” between the sandbox and the app running. I do know that flatpak does have this option for at least the file picker dialog, which is a good direction, but ideally the mobile OS’s permission system should be adapted in some way. My gripe with flatpak is that it mixes up a (imo bad) way of packaging with sandboxing.
- SanjayMehta 4y agoNo anti-virus on any machine except my brother-in-law's laptop. He loves downloading "free" screensavers and the like.
- jjcinaz 4y agoNo. Antivirus software is a scam on any OS. But don’t tell that to the sheep — we don’t want to spook them.
- perryizgr8 4y agoI don't even use an anti-virus on my windows PC.
- timbit42 4y agoSo you disabled Windows Defender?
- perryizgr8 4y agoAh, no I haven't disabled that. So it must be running.
- Fire-Dragon-DoL 4y agoYes for compliance reasons. I use clamav because I found it in the repos and was the only functioning one.
- Nasreddin_Hodja 4y agoNo and I wouldn't use it on Windows. I used Windows before 2007 but never had problems with viruses. Mostly they come with pirated software.
- azaras 4y agoClamAV because of Pulse secure VPN demands it.
- wink 4y agoThe only Antivirus that has not yet bitten me is Microsoft Defender. I'm not usually one to praise MS, but this one eliminated a whole category of problems for me and many other people, especially non-technical folks. It works 99% of the time and they have their peace of mind and it doesn't mess up their system. As for Linux... I was trialing something at a last job and it slowed compile times to 1/3 of the speed and did some other things. Glad I could save my coworkers the experience by writing a detailed report of why this is a bad idea for dev machines.
- gabrielsroka 4y agosee poll results on https://gabrielsroka.github.io/hnpoll.html?id=34540600 https://gabrielsroka.github.io/hnpoll.html?id=34540600