20 ms·

As long as some platform is capable and powerful for many things, there will be malware. The reason why most (consumer-facing at least) malware isn't targeting

As long as some platform is capable and powerful for many things, there will be malware. The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. It's way better to target Windows on desktop since you can reach way more users that way. The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. (Except tracking. Because guess what, the company who makes the OS also sells ads.)

howinteresting 3y ago
Heterogeneity is an important part of defense in depth. Monocultures are more likely to be attacked.
dacryn 3y ago
I don't fully agree on this one. Linux has a wider attack vector since there are tons of packages out there. Yet the core has a lot of attention and many eyes on it, just because it is so open. Vulnerabilities get patched rather sooner than later. Linux versions and gnu packages are running basically the entire internet, so there is definitely incentive to break into into it. It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on.
- nradov 3y ago
  Is there any evidence that security vulnerabilities are on average fixed faster in the major Linux distributions than in Windows?
  - chmod775 3y ago
    Some. Here's for the Linux Kernel: https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html https://googleprojectzero.blogspot.com/2022/02/a-walk-throug... The dataset is quite small, but on average it took Linux 25 days to fix a 0-day while it took Microsoft 83 days.
    - schemescape 3y ago
      Does that metric include the delay if fixes getting incorporated into Linux distributions (and pushed out, assuming automatic updates—maybe not a good assumption) or Windows fixes getting deployed via Windows Update? Edit: I don’t know much about this topic, but thought “time to deployment of a fix” might be more useful. Edit again: also unclear if the comparison is “apples to apples”.
      - RunSet 3y ago
        I doubt it, any more than it includes the time it takes procrastinating users to actually update their systems.
    - de-moray 3y ago
      The dataset does not appear to discuss the lifecycle of Linux distributions taking the security patches from upstream, nor the update process for all of the downstream distributions. Something that's been widely discussed elsewhere is how often security issues are silently fixed in Linus's repo and therefore not picked up by distributions for their stable/LTS releases. I buy the immediacy of patches if you compile your own kernel from the latest kernel.org sources, not if you're relying on distributions.
- SoftTalker 3y ago
  > It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on. Is this true? It's been a while but I remember being able to set performance monitors on almost anything in Windows. It seemed to have very robust instrumentation support.
- nequo 3y ago
  > Linux has a wider attack vector Nit but you probably mean attack surface. A vector doesn't have a width.
- rodgerd 3y ago
  > Vulnerabilities get patched rather sooner than later. Unless they're in the file systems, in which case it's in the too hard basket.
jolux 3y ago
> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. macOS is headed in this direction. Qubes is a more radical example and I think probably the future of desktop computing: everything will run in its own virtual machine.
- delfinom 3y ago
  >There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. That's the direction Windows is going as well with the MS-Store and appx/msix bundles. There's also Process Memory protection by using virtualization https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78 https://support.microsoft.com/en-us/windows/core-isolation-e...
- FireInsight 3y ago
  This is where Linux is going as well. I believe that in the future most peoples base systems will contain only necessary packages and other software will be run out of Flatpaks or a comparable technology separate from the host.
  - nickstinemates 3y ago
    This is how I run everything outside of coreutils in Linux. Either with VM isolation or packed away in a container. Host is basically a hypervisor with external monitoring and logging.
  - jchw 3y ago
    Flatpak right now isn't really a security boundary. That said, I don't think there's any particular reason it couldn't or shouldn't be in the future. The model seems amenable to it, and maybe it was at one point the intent even.
- vorpalhex 3y ago
Retric 3y ago
Sandboxing isn’t incompatible with a highly customizable OS. Malware is really more a question of being able to install software without the users control and the inability to remove such installations after the fact. Windows suffers from Malware in no small part due to the systems design rather than simply being common. Plenty of alternatives have more users than windows did back in the late 90’s when it was a huge target.
- s1gsegv 3y ago
  I think the crux of the issue is that making a system that's customizable AND sandboxing AND user friendly multiplies together to create development and testing effort that's not palatable for most right now. Even the open source offerings that add sandboxing often drop either the customizability or the user friendliness.
- zzo38computer 3y ago
  > Sandboxing isn’t incompatible with a highly customizable OS. This is true, but there is much badly designed sandboxing. Many of the sandbox systems on Linux will have some problems, including too broad permissions, assuming text (including file names) is Unicode, failure to consider permissions that differ by command-line switches and other configuration files, failing to consider other things that the user might want to connect access to devices by files and other programs, and in case it prompts the user (at run time) for the name of another program to run by using popen or something like that and that program should run using its own permissions instead, etc. (Many of my programs that have an interactive mode do run other programs with popen, which prompt the user at run time to specify what command to run, so it can vary.) I had my own ideas of operating system design, which is different from POSIX (although there is a POSIX compatibility layer available as a C library; the kernel need not know anything about it). One of its major ideas is that it uses capability-based security with proxy capabilities; these can be used for sandboxing and other high-level features implemented in terms of proxy capabilities. All I/O (except the Yield and Quit syscalls) requires capabilities; capabilities (as well as links) can also be passed in messages through other capabilities, including the initial message. There are many other ideas too, including ways for programs to be connected together and with user codes by user specifications. These ideas can allow working without dropping customizability, etc (in fact, the way I thought to do, would actually improve customizability, even for programs that do not normally have this feature).
everdrive 3y ago
This is definitely true, and I think there are at least two points worth considering here. - Part of what makes the mainstream OS terrible is the mere fact that it is mainstream. If Linux hit 60-70% adoption, a plague of terrible software, adware, malware, and more would start degrading its quality. - Despite the points above, it would be really nice if some of the lousy things pointed out the in the graphic were deprecated.
- bee_rider 3y ago
  Free Software licenses typically say basically “I’m giving you this for free, so you take it as it is, no promises.” You get the guarantees that you pay for. But nobody would write some of the absolute schlock they get over in proprietary-land if they didn’t think they could dupe unwitting consumers into paying for it.
mcpackieh 3y ago
Popularity was the canned cope for why Windows 95 through XP were riddled with so much malware. But then Microsoft started taking security more seriously with Vista and onwards. The situation didn't turn into sunshine and roses, but it did improve dramatically. It turns out that popularity wasn't the problem, the problem was the insecure nature of the software. There is of course still a lot of room for improvement.
- phendrenad2 3y ago
  The possibility of there being a confluence of problems is one that's hard to grok, but doing so is ultimately fruitful.
- dj_mc_merlin 3y ago
  As opposed to the Linux security best practices of curl | bash? I have no choice but to set up my computer to run untrusted code, on a CPU which itself might be spying on me -- I don't feel like my environment is inherently more secure than Windows at all. Just less popular.
  - pxc 3y ago
    > the Linux security best practices of curl | bash? You do realize that even this is the same as downloading and running an executable from a website, which is still the norm on Windows, right?
    - xigoi 3y ago
      In fact, curl | bash is safer, because you can replace "| bash" with "| less" and inspect the script.
      - xmodem 3y ago
        I would argue that Windows checking certificate signatures provides a lot more safety to the vast majority of users than manually inspecting a bash script.
soraminazuki 3y ago
Wait, you say malware don't target Linux because it has no market share? The OS that is ubiquitous on servers and mobile?
- vuln 3y ago
  Typically there aren’t users on the servers. The servers aren’t used for browsing the internet or checking emails.
  - lelanthran 3y ago
    The rewards are greater on the server. If you pwn just one server you can attack thousands of people, their data, their credentials, etc. Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger.
    - vuln 3y ago
      > Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger. I didn’t say that. My comment was really just commenting on the fact that most attacks (mal/ransomware/phishing/exploits) very frequently need some sort of user interaction. Without users or users doing user stuff it makes it harder to get things to execute on the machine/server. Sure if the server is in the DMZ and unpatched then yes it will be hammered by scanners and automated exploiters. With proper security hygiene and a proper patch cadence servers are usually more protected through defense in depth and lack of human.
      - lelanthran 3y ago
        You are correct, you most certainly did not say that, and I apologise for implying that you did. Mea culpa.
    - sanitycheck 3y ago
      They're configured and administered by professionals though, not your grandma (probably).
lofatdairy 3y ago
I think there's a unique element to Windows with it's attempt to be extremely backwards compatible. This can be a tremendous boon when, say, running older software targeting a previous OS, but introduces vulnerabilities since your dependency tree has such deep roots. It's definitely a good target because god knows how many banks/hospitals/etc are running windows and have critical business data in Excel sheets or Power BI or whatever, but it doesn't help that Windows itself is constructed of layers and layers of older code that can't be sacrificed without wrecking some client workflow. I mean that screenshot of 10 different design styles in Windows 11 kinda goes to show how much of it is just ported over kinda arbitrarily.
Beached 3y ago
Linux has both a huge stack surface and a huge focus on the malware and TA sphere. I worry about my Linux environment far more than my Windows environment. properly securing, monitoring and responding in a Linux environment is much harder than a windows environment for a SOC. the enterprise tool set lags in this space by a lot, and the TAs targeting Linux are generally FAR more sophisticated.
cogman10 3y ago
It seems like your thesis is disproved in your own examples. Linux is hugely popular on phones (android), which are every bit as juicy (if not more so at this point) than a desktop target. There is mobile malware but it's far more rare and harder to come by. But then there's just the fact that the way software is installed on a linux machine is wildly different from how you'd install it on windows. Just getting that binary blob to run requires some heroic efforts (To the point where we've pretty much decided it's easier to distribute via containers rather than compiled binaries for a given desktop). And if we expand beyond the desktop, we find linux everywhere in the server world. Easily the most popular OS to run server software. Which makes it a hugely valuable target for hackers. They'd love nothing more than to compromise a bank server. To say there's nothing about linux that makes it inherently more secure than windows seems just unreal. Because nix was designed around multiple users from the ground up, user permissions have been baked into the common flow for decades. That alone creates a huge layer of security that makes things like root kits or worms running at root super hard to pull off. The old windows (9->XP) pretty much gave everyone running admin permissions. Writing or changing a system32 dll was child's play. To exploit linux, you have to either trick a user to run something with elevated permissions or find a vulnerability in software running with root permissions. To exploit windows (particularly older windows) you have to trick a user to run your software.
- gochi 3y ago
  Android malware isn't rare or harder to come by at all. Every so often even Google has to remove a whole lot of apps from the store due to malware and these are apps that went live and were downloaded. Some of this being even more intense malware than on desktop, as people rarely store contacts or SMS on a desktop (Joker malware for example). You've negated your entire point.
  - bscphil 3y ago
    The vast majority of "malware" on phones isn't software that exploits security bugs in the system software. Instead it's software that effectively asks the user nicely to give up their information, using mechanisms provided by the system software to do just that. This isn't something you can trivially prevent, as some software really does need access to your location, contacts, SMS, etc. The response to true malware on Android isn't looking for and removing APKs from compromised devices after the fact, it's patching the vulnerabilities in system APIs.
charcircuit 3y ago
You are underestimating the amount of IOT botnets that run on Linux and the amount of Android malware.
throw47474777j 3y ago
This argument is very unpopular when it’s used to explain why iOS is locked down. Usually there is a lot of pushback along the lines that APIs should simply be made secure.
666satanhimself 3y ago
[dead]
jrm4 3y ago
This is such crap. A very long time ago, Windows normalized the absolute worst security practices ever. This was never meaningfully addressed/punished publicly and we just kind of drifted to today -- where we're stuck with absurdities like the fact that you can't use a USB key literally as intended. No other product is this bad in terms of security; bread will not destroy your toaster the way a USB key can your computer. You can't JUST put this on market share.
- mrguyorama 3y ago
  Windows being inherently insecure hasn't been the issue since at least mid-XP. It's also a completely moot point, because nearly any security breach since then could have been conducted over snail mail, because it has nothing to do with how computers are programmed. While everyone was complaining about windows security, stuff like shellshock sat in the open for decades, including on all the servers that were supposedly so secure. Every organization that does internal phishing testing still fails every time. Any modern discussion about information security that doesn't deal with that is a red herring, and provides zero utility to anyone who isn't the enemy of a nation-state. Focusing on the remaining few buffer-overflows that take a chain of ten other exploits to even reach in the first place while everyone's data and info is leaked daily because the CEO clicks everything in an email is a dereliction of duty. It's like investing in StarWars and magic lasers that can't work while placing nukes on Moscow's door step. "Security Researches" keep looking for the buffer overflows because that's fun and they don't want to admit that the real problem is a social one because that's hard and boring and doesn't let them play with the newest fuzzer or get them a $100k bounty.
  - jrm4 3y ago
    I get what you mean here, but I still can't help but think that the Windows "make everything run really easy" mentality still crept in and stuck around,and to this day prevents software from implementing better ideas of "who or what really needs to run executable code?" Like Javascript? Sure, it's VERY versatile, but "just download arbitrary code and run it in the browser?" That should have never happened in the way it has.
trelane 3y ago
> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. This is also why there's not as much software in general. So if a (lack of) regular software is a valid reason to not use linux, a lack of malware is also a valid reason to use it.
mdgrech23 3y ago
Would argue 95+% of people would find w/ this kind of setup on their desktop.
failuser 3y ago
Proper sandboxing in Unix was a missing feature forever since SUID bit was introduced and was slowly mitigated by adding layers of virtualization instead of OS-level controls.
marcodiego 3y ago
> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. I don't eat that argument anymore. In the mobile space, Android (Linux) is the biggest player. It is even bigger than windows if both are considered among end-users[1] and I don't see as many people complaining about malware on Android as people complain about it on windows. Of course, I don't think ms is incompetent with regards to windows security. But there are design decisions that make it historically problematic. The fact that win9x had zero process isolation (although with was possible since i386) and people expect program to continue working on winxp (NT kernel), the fact that centralized software distribution is a relatively novelty on windows (compared to apt which exists since 1998) and many other minor things, like extension hiding, make it an easier target than ChromeOS, iOS, Android, MacOS and GNU/Linux. I remember people saying "when Linux become as popular as windows, you'll see it being target by malware devs". Well, consider smartvs, infotainment, servers, supercomputers, embedded systems, mobile (specially Android). Linux is bigger than windows for a long time. I don't think its lower desktop market share is the main reason for its lack of malware. [1] https://gs.statcounter.com/os-market-share#monthly-202206-202307 https://gs.statcounter.com/os-market-share#monthly-202206-20...
- dartharva 3y ago
  > I don't see as many people complaining about malware on Android as people complain about it on windows. Can't believe I'm seeing such a statement on HN. Android phones are arguably worse on malware-related threat vectors, especially when most OEMs themselves package in the majority of malware on consumer phones to begin with. Even assuming less dumb users, at its best it is an unholy combination of adware mixed with spyware, ridiculous amounts of tracking in the name of "telemetry" and consumer-hostile design choices often literally designed to make the user choose the wrong option. Combine that with how ridiculously easy it is to get malware installed on Android (the most popular apps and games on the Play Store are all adware, installing compromised "modded" apks that "unlock premium features" is just one tap away) and you get a platform that would make any infosec manager cry. At least Windows PCs are controllable by the organization's administrator, how are you going to control people's phones unless you start issuing company phones as well?
orbital-decay 3y ago
> As long as some platform is capable and powerful for many things, there will be malware. This is true but there are also degrees of that. Windows in particular is a graveyard of discarded tech waiting to be galvanized by malware, because of the backwards compatibility and because of the Microsoft's habit of abandoning the half-done frameworks and APIs. Apple's stuff is much tidier just because they regularly deprecate and compress their fully owned stack (although they also have their turds of course). In Linux, there's terrible fragmentation and a lot of ancient and barely maintained stuff, but at the same time it can be customized to only include the best practices and omit a lot of dead weight.
INTPenis 3y ago
>As long as some platform is capable and powerful for many things, there will be malware. Might want to rephrase that, uhm, Linux? Windows is a platform that is accessible to the most dumb (and disinterested) users in the world. No offense, but phishers, malware authors and spammers all rely on a sucker buying OEM every minute.
eikenberry 3y ago
You can lock down your computer and keep it a computer. For an example look at the work going on with Fedora Silverblue [1] where you have an immutable OS install and use containers and flatpaks for everything. It is coming along nicely with side projects to allow for customization via Dockerfiles [2]. [1] https://fedoraproject.org/silverblue/ https://fedoraproject.org/silverblue/ [2] https://github.com/ublue-os https://github.com/ublue-os
- rcarr 3y ago
  Steam OS also works this way.
CyberRage 3y ago
I see a ton of linux malware as part of my job but it's a different kind to windows malware(which I also reverse/research) in Linux the focus is on server/enterprise so things like webshells, miners, data scraping are very common
kazinator 3y ago
Apple Macs had like single digit percentage market share in the 1980's, yet were havens for viruses.
xorcist 3y ago
It's not just the kernel, it's the whole ecosystem. How does Linux have anything resembling OLE? SMB? Sharepoint paths on the public Internet? It's an operating system that automatically executes code found on USB sticks. How is this even a discussion?
abrookewood 3y ago
I'm far from a security expert, but this article (or a related one) was posted recently on HN and it covers some fairly technical reasons why Linux isn't as secure as commonly believe [0]. While that may be true, I think in practical terms you are less likely to encounter malware etc on Linux than Windows, but that could very well be because it is a smaller target as you mention. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
georgeplusplus 3y ago
I thought PIP and apt upgrade/update were found to have really malicious packages you could easily pull and install.
throw10920 3y ago
> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. Your understanding of security research is badly out of date. Turns out that, since the 80's, we've found a lot of ways to make computing platforms much more secure while sacrificing little flexibility. For instance: capabilities. Apps working under a capability model get denied access to resources by default. If you later determine that yes, you want a program to be able to access the internet, then you can grant it that capability...but, say, only while the program is running, and you can revoke it at any time. The dichotomy of "either malware or a locked down media-consumption device" is completely false.
ensocode 3y ago
This and I think Linux desktop is way less attractive as a target as not used on corporate machines so often. Corporate Windows desktops might be more much more interesting data-wise.

howinteresting 3y ago

Heterogeneity is an important part of defense in depth. Monocultures are more likely to be attacked.

dacryn 3y ago

I don't fully agree on this one. Linux has a wider attack vector since there are tons of packages out there. Yet the core has a lot of attention and many eyes on it, just because it is so open. Vulnerabilities get patched rather sooner than later. Linux versions and gnu packages are running basically the entire internet, so there is definitely incentive to break into into it. It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on.

nradov 3y ago
Is there any evidence that security vulnerabilities are on average fixed faster in the major Linux distributions than in Windows?
- chmod775 3y ago
  Some. Here's for the Linux Kernel: https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html https://googleprojectzero.blogspot.com/2022/02/a-walk-throug... The dataset is quite small, but on average it took Linux 25 days to fix a 0-day while it took Microsoft 83 days.
  - schemescape 3y ago
    Does that metric include the delay if fixes getting incorporated into Linux distributions (and pushed out, assuming automatic updates—maybe not a good assumption) or Windows fixes getting deployed via Windows Update? Edit: I don’t know much about this topic, but thought “time to deployment of a fix” might be more useful. Edit again: also unclear if the comparison is “apples to apples”.
    - RunSet 3y ago
      I doubt it, any more than it includes the time it takes procrastinating users to actually update their systems.
  - de-moray 3y ago
    The dataset does not appear to discuss the lifecycle of Linux distributions taking the security patches from upstream, nor the update process for all of the downstream distributions. Something that's been widely discussed elsewhere is how often security issues are silently fixed in Linus's repo and therefore not picked up by distributions for their stable/LTS releases. I buy the immediacy of patches if you compile your own kernel from the latest kernel.org sources, not if you're relying on distributions.
SoftTalker 3y ago
> It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on. Is this true? It's been a while but I remember being able to set performance monitors on almost anything in Windows. It seemed to have very robust instrumentation support.
nequo 3y ago
> Linux has a wider attack vector Nit but you probably mean attack surface. A vector doesn't have a width.
rodgerd 3y ago
> Vulnerabilities get patched rather sooner than later. Unless they're in the file systems, in which case it's in the too hard basket.

jolux 3y ago

> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. macOS is headed in this direction. Qubes is a more radical example and I think probably the future of desktop computing: everything will run in its own virtual machine.

delfinom 3y ago
>There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. That's the direction Windows is going as well with the MS-Store and appx/msix bundles. There's also Process Memory protection by using virtualization https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78 https://support.microsoft.com/en-us/windows/core-isolation-e...
FireInsight 3y ago
This is where Linux is going as well. I believe that in the future most peoples base systems will contain only necessary packages and other software will be run out of Flatpaks or a comparable technology separate from the host.
- nickstinemates 3y ago
  This is how I run everything outside of coreutils in Linux. Either with VM isolation or packed away in a container. Host is basically a hypervisor with external monitoring and logging.
- jchw 3y ago
  Flatpak right now isn't really a security boundary. That said, I don't think there's any particular reason it couldn't or shouldn't be in the future. The model seems amenable to it, and maybe it was at one point the intent even.
vorpalhex 3y ago

Retric 3y ago

Sandboxing isn’t incompatible with a highly customizable OS. Malware is really more a question of being able to install software without the users control and the inability to remove such installations after the fact. Windows suffers from Malware in no small part due to the systems design rather than simply being common. Plenty of alternatives have more users than windows did back in the late 90’s when it was a huge target.

s1gsegv 3y ago
I think the crux of the issue is that making a system that's customizable AND sandboxing AND user friendly multiplies together to create development and testing effort that's not palatable for most right now. Even the open source offerings that add sandboxing often drop either the customizability or the user friendliness.
zzo38computer 3y ago
> Sandboxing isn’t incompatible with a highly customizable OS. This is true, but there is much badly designed sandboxing. Many of the sandbox systems on Linux will have some problems, including too broad permissions, assuming text (including file names) is Unicode, failure to consider permissions that differ by command-line switches and other configuration files, failing to consider other things that the user might want to connect access to devices by files and other programs, and in case it prompts the user (at run time) for the name of another program to run by using popen or something like that and that program should run using its own permissions instead, etc. (Many of my programs that have an interactive mode do run other programs with popen, which prompt the user at run time to specify what command to run, so it can vary.) I had my own ideas of operating system design, which is different from POSIX (although there is a POSIX compatibility layer available as a C library; the kernel need not know anything about it). One of its major ideas is that it uses capability-based security with proxy capabilities; these can be used for sandboxing and other high-level features implemented in terms of proxy capabilities. All I/O (except the Yield and Quit syscalls) requires capabilities; capabilities (as well as links) can also be passed in messages through other capabilities, including the initial message. There are many other ideas too, including ways for programs to be connected together and with user codes by user specifications. These ideas can allow working without dropping customizability, etc (in fact, the way I thought to do, would actually improve customizability, even for programs that do not normally have this feature).

everdrive 3y ago

This is definitely true, and I think there are at least two points worth considering here. - Part of what makes the mainstream OS terrible is the mere fact that it is mainstream. If Linux hit 60-70% adoption, a plague of terrible software, adware, malware, and more would start degrading its quality. - Despite the points above, it would be really nice if some of the lousy things pointed out the in the graphic were deprecated.

bee_rider 3y ago
Free Software licenses typically say basically “I’m giving you this for free, so you take it as it is, no promises.” You get the guarantees that you pay for. But nobody would write some of the absolute schlock they get over in proprietary-land if they didn’t think they could dupe unwitting consumers into paying for it.

mcpackieh 3y ago

Popularity was the canned cope for why Windows 95 through XP were riddled with so much malware. But then Microsoft started taking security more seriously with Vista and onwards. The situation didn't turn into sunshine and roses, but it did improve dramatically. It turns out that popularity wasn't the problem, the problem was the insecure nature of the software. There is of course still a lot of room for improvement.

phendrenad2 3y ago
The possibility of there being a confluence of problems is one that's hard to grok, but doing so is ultimately fruitful.
dj_mc_merlin 3y ago
As opposed to the Linux security best practices of curl | bash? I have no choice but to set up my computer to run untrusted code, on a CPU which itself might be spying on me -- I don't feel like my environment is inherently more secure than Windows at all. Just less popular.
- pxc 3y ago
  > the Linux security best practices of curl | bash? You do realize that even this is the same as downloading and running an executable from a website, which is still the norm on Windows, right?
  - xigoi 3y ago
    In fact, curl | bash is safer, because you can replace "| bash" with "| less" and inspect the script.
    - xmodem 3y ago
      I would argue that Windows checking certificate signatures provides a lot more safety to the vast majority of users than manually inspecting a bash script.

soraminazuki 3y ago

Wait, you say malware don't target Linux because it has no market share? The OS that is ubiquitous on servers and mobile?

vuln 3y ago
Typically there aren’t users on the servers. The servers aren’t used for browsing the internet or checking emails.
- lelanthran 3y ago
  The rewards are greater on the server. If you pwn just one server you can attack thousands of people, their data, their credentials, etc. Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger.
  - vuln 3y ago
    > Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger. I didn’t say that. My comment was really just commenting on the fact that most attacks (mal/ransomware/phishing/exploits) very frequently need some sort of user interaction. Without users or users doing user stuff it makes it harder to get things to execute on the machine/server. Sure if the server is in the DMZ and unpatched then yes it will be hammered by scanners and automated exploiters. With proper security hygiene and a proper patch cadence servers are usually more protected through defense in depth and lack of human.
    - lelanthran 3y ago
      You are correct, you most certainly did not say that, and I apologise for implying that you did. Mea culpa.
  - sanitycheck 3y ago
    They're configured and administered by professionals though, not your grandma (probably).

lofatdairy 3y ago

I think there's a unique element to Windows with it's attempt to be extremely backwards compatible. This can be a tremendous boon when, say, running older software targeting a previous OS, but introduces vulnerabilities since your dependency tree has such deep roots. It's definitely a good target because god knows how many banks/hospitals/etc are running windows and have critical business data in Excel sheets or Power BI or whatever, but it doesn't help that Windows itself is constructed of layers and layers of older code that can't be sacrificed without wrecking some client workflow. I mean that screenshot of 10 different design styles in Windows 11 kinda goes to show how much of it is just ported over kinda arbitrarily.

Beached 3y ago

Linux has both a huge stack surface and a huge focus on the malware and TA sphere. I worry about my Linux environment far more than my Windows environment. properly securing, monitoring and responding in a Linux environment is much harder than a windows environment for a SOC. the enterprise tool set lags in this space by a lot, and the TAs targeting Linux are generally FAR more sophisticated.

cogman10 3y ago

It seems like your thesis is disproved in your own examples. Linux is hugely popular on phones (android), which are every bit as juicy (if not more so at this point) than a desktop target. There is mobile malware but it's far more rare and harder to come by. But then there's just the fact that the way software is installed on a linux machine is wildly different from how you'd install it on windows. Just getting that binary blob to run requires some heroic efforts (To the point where we've pretty much decided it's easier to distribute via containers rather than compiled binaries for a given desktop). And if we expand beyond the desktop, we find linux everywhere in the server world. Easily the most popular OS to run server software. Which makes it a hugely valuable target for hackers. They'd love nothing more than to compromise a bank server. To say there's nothing about linux that makes it inherently more secure than windows seems just unreal. Because nix was designed around multiple users from the ground up, user permissions have been baked into the common flow for decades. That alone creates a huge layer of security that makes things like root kits or worms running at root super hard to pull off. The old windows (9->XP) pretty much gave everyone running admin permissions. Writing or changing a system32 dll was child's play. To exploit linux, you have to either trick a user to run something with elevated permissions or find a vulnerability in software running with root permissions. To exploit windows (particularly older windows) you have to trick a user to run your software.

gochi 3y ago
Android malware isn't rare or harder to come by at all. Every so often even Google has to remove a whole lot of apps from the store due to malware and these are apps that went live and were downloaded. Some of this being even more intense malware than on desktop, as people rarely store contacts or SMS on a desktop (Joker malware for example). You've negated your entire point.
- bscphil 3y ago
  The vast majority of "malware" on phones isn't software that exploits security bugs in the system software. Instead it's software that effectively asks the user nicely to give up their information, using mechanisms provided by the system software to do just that. This isn't something you can trivially prevent, as some software really does need access to your location, contacts, SMS, etc. The response to true malware on Android isn't looking for and removing APKs from compromised devices after the fact, it's patching the vulnerabilities in system APIs.

charcircuit 3y ago

You are underestimating the amount of IOT botnets that run on Linux and the amount of Android malware.

throw47474777j 3y ago

This argument is very unpopular when it’s used to explain why iOS is locked down. Usually there is a lot of pushback along the lines that APIs should simply be made secure.

666satanhimself 3y ago

[dead]

jrm4 3y ago

This is such crap. A very long time ago, Windows normalized the absolute worst security practices ever. This was never meaningfully addressed/punished publicly and we just kind of drifted to today -- where we're stuck with absurdities like the fact that you can't use a USB key literally as intended. No other product is this bad in terms of security; bread will not destroy your toaster the way a USB key can your computer. You can't JUST put this on market share.

mrguyorama 3y ago
Windows being inherently insecure hasn't been the issue since at least mid-XP. It's also a completely moot point, because nearly any security breach since then could have been conducted over snail mail, because it has nothing to do with how computers are programmed. While everyone was complaining about windows security, stuff like shellshock sat in the open for decades, including on all the servers that were supposedly so secure. Every organization that does internal phishing testing still fails every time. Any modern discussion about information security that doesn't deal with that is a red herring, and provides zero utility to anyone who isn't the enemy of a nation-state. Focusing on the remaining few buffer-overflows that take a chain of ten other exploits to even reach in the first place while everyone's data and info is leaked daily because the CEO clicks everything in an email is a dereliction of duty. It's like investing in StarWars and magic lasers that can't work while placing nukes on Moscow's door step. "Security Researches" keep looking for the buffer overflows because that's fun and they don't want to admit that the real problem is a social one because that's hard and boring and doesn't let them play with the newest fuzzer or get them a $100k bounty.
- jrm4 3y ago
  I get what you mean here, but I still can't help but think that the Windows "make everything run really easy" mentality still crept in and stuck around,and to this day prevents software from implementing better ideas of "who or what really needs to run executable code?" Like Javascript? Sure, it's VERY versatile, but "just download arbitrary code and run it in the browser?" That should have never happened in the way it has.

trelane 3y ago

> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. This is also why there's not as much software in general. So if a (lack of) regular software is a valid reason to not use linux, a lack of malware is also a valid reason to use it.

mdgrech23 3y ago

Would argue 95+% of people would find w/ this kind of setup on their desktop.

failuser 3y ago

Proper sandboxing in Unix was a missing feature forever since SUID bit was introduced and was slowly mitigated by adding layers of virtualization instead of OS-level controls.

marcodiego 3y ago

> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. I don't eat that argument anymore. In the mobile space, Android (Linux) is the biggest player. It is even bigger than windows if both are considered among end-users[1] and I don't see as many people complaining about malware on Android as people complain about it on windows. Of course, I don't think ms is incompetent with regards to windows security. But there are design decisions that make it historically problematic. The fact that win9x had zero process isolation (although with was possible since i386) and people expect program to continue working on winxp (NT kernel), the fact that centralized software distribution is a relatively novelty on windows (compared to apt which exists since 1998) and many other minor things, like extension hiding, make it an easier target than ChromeOS, iOS, Android, MacOS and GNU/Linux. I remember people saying "when Linux become as popular as windows, you'll see it being target by malware devs". Well, consider smartvs, infotainment, servers, supercomputers, embedded systems, mobile (specially Android). Linux is bigger than windows for a long time. I don't think its lower desktop market share is the main reason for its lack of malware. [1] https://gs.statcounter.com/os-market-share#monthly-202206-202307 https://gs.statcounter.com/os-market-share#monthly-202206-20...

dartharva 3y ago
> I don't see as many people complaining about malware on Android as people complain about it on windows. Can't believe I'm seeing such a statement on HN. Android phones are arguably worse on malware-related threat vectors, especially when most OEMs themselves package in the majority of malware on consumer phones to begin with. Even assuming less dumb users, at its best it is an unholy combination of adware mixed with spyware, ridiculous amounts of tracking in the name of "telemetry" and consumer-hostile design choices often literally designed to make the user choose the wrong option. Combine that with how ridiculously easy it is to get malware installed on Android (the most popular apps and games on the Play Store are all adware, installing compromised "modded" apks that "unlock premium features" is just one tap away) and you get a platform that would make any infosec manager cry. At least Windows PCs are controllable by the organization's administrator, how are you going to control people's phones unless you start issuing company phones as well?

orbital-decay 3y ago

> As long as some platform is capable and powerful for many things, there will be malware. This is true but there are also degrees of that. Windows in particular is a graveyard of discarded tech waiting to be galvanized by malware, because of the backwards compatibility and because of the Microsoft's habit of abandoning the half-done frameworks and APIs. Apple's stuff is much tidier just because they regularly deprecate and compress their fully owned stack (although they also have their turds of course). In Linux, there's terrible fragmentation and a lot of ancient and barely maintained stuff, but at the same time it can be customized to only include the best practices and omit a lot of dead weight.

INTPenis 3y ago

>As long as some platform is capable and powerful for many things, there will be malware. Might want to rephrase that, uhm, Linux? Windows is a platform that is accessible to the most dumb (and disinterested) users in the world. No offense, but phishers, malware authors and spammers all rely on a sucker buying OEM every minute.

eikenberry 3y ago

You can lock down your computer and keep it a computer. For an example look at the work going on with Fedora Silverblue [1] where you have an immutable OS install and use containers and flatpaks for everything. It is coming along nicely with side projects to allow for customization via Dockerfiles [2]. [1] https://fedoraproject.org/silverblue/ https://fedoraproject.org/silverblue/ [2] https://github.com/ublue-os https://github.com/ublue-os

rcarr 3y ago
Steam OS also works this way.

CyberRage 3y ago

I see a ton of linux malware as part of my job but it's a different kind to windows malware(which I also reverse/research) in Linux the focus is on server/enterprise so things like webshells, miners, data scraping are very common

kazinator 3y ago

Apple Macs had like single digit percentage market share in the 1980's, yet were havens for viruses.

xorcist 3y ago

It's not just the kernel, it's the whole ecosystem. How does Linux have anything resembling OLE? SMB? Sharepoint paths on the public Internet? It's an operating system that automatically executes code found on USB sticks. How is this even a discussion?

abrookewood 3y ago

I'm far from a security expert, but this article (or a related one) was posted recently on HN and it covers some fairly technical reasons why Linux isn't as secure as commonly believe [0]. While that may be true, I think in practical terms you are less likely to encounter malware etc on Linux than Windows, but that could very well be because it is a smaller target as you mention. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html

georgeplusplus 3y ago

I thought PIP and apt upgrade/update were found to have really malicious packages you could easily pull and install.

throw10920 3y ago

> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. Your understanding of security research is badly out of date. Turns out that, since the 80's, we've found a lot of ways to make computing platforms much more secure while sacrificing little flexibility. For instance: capabilities. Apps working under a capability model get denied access to resources by default. If you later determine that yes, you want a program to be able to access the internet, then you can grant it that capability...but, say, only while the program is running, and you can revoke it at any time. The dichotomy of "either malware or a locked down media-consumption device" is completely false.

ensocode 3y ago

This and I think Linux desktop is way less attractive as a target as not used on corporate machines so often. Corporate Windows desktops might be more much more interesting data-wise.