6 ms·

Never in 20 years of using Linux/Macs I’ve ever needed anti-virus.

charcircuit 1y ago
You have been lucky. It's trivial for someone to write a stealer and trick someone to run it. For example there's been stealers targeting Linux built into trojans of Minecraft mods.
- aquariusDue 1y ago
  As another lucky soul do you happen to know of a case documented somewhere?
  - charcircuit 1y ago
    For example. https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool https://support.curseforge.com/en/support/solutions/articles...
    - aquariusDue 1y ago
      That is wild, the numbers are much bigger than I expected. Thanks for sharing!
pjmlp 1y ago
Many people also never need insurances, until they do. How is that curl https://... | sudo sh going?
- saagarjha 1y ago
  Given its prevalence, I think it's actually going surprisingly well
  - mike_hearn 1y ago
    Only if you ignore the "npm install" or "pip install" moral equivalent. Free open source packages that come with a side helping of malware have become common in recent years.
    - saagarjha 1y ago
      Oh I included that I just think that statically things are mostly going fine (unless we are all secretly backdoored in a way that has yet to be made public).
mike_hearn 1y ago
Macs come with an Apple provided antivirus built in, it's called XProtect. Apple also has enforced a similar policy to what Google is doing, but much stricter, and has done for ~13 years or so (devs must be identified, the OS rejects unsigned code in all territories by default, Apple pre-approves all binaries even outside the app store). Linux distros have policies far more extreme than anything Google, Apple or Microsoft have ever done. They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone, reject it for any reason or no reason at all (including reasons like "we don't have time"), and they tie getting new releases of your app to the user upgrading to new releases of the OS. If you do try and install stuff from outside of your distribution, not only are there security warnings to click through but an expected outcome is that the OS breaks and the vendor washes their hands of you. Despite those policies, or perhaps because of them, botnets of Linux servers are common. Of all consumer-facing platforms only Windows and Android allow installation of unsigned third party code out of the box via some obvious graphical path. And on Windows that right is somewhat theoretical. You can do it but the built in browser will try very hard to stop you, and the OS itself will happily break unsigned code by blocking file open syscalls heuristically. So in practice most apps don't go the unsigned route. On Android OTOH, unsigned (non ID verified) code is sandboxed and works just like regular apps after installation, the OS won't heuristically interfere with the app.
- BLKNSLVR 1y ago
  That's an interesting take on Linux. I see it as a lot closer to what Windows programs were like back in the day, where you can install whatever you want. Linux distributions each have their built in package managers, but there's no 'policy', as I understand it, that prevents installation of, literally, whatever you want. It's generally more difficult than just downloading and double clicking on the installer / exe, but just follow the instructions and it's done. And, yes, also there are weird version and dependency issues that crop up more than would be ideal, but that's not the topic.
  - mike_hearn 1y ago
zeta0134 1y ago
Never in those 20 years did I need one on Windows either. It turns out if you vet the software you install in the first place, malware is pretty rare. That isn't the bar for most regular users of software though. Working in retail tech support, we got folks bringing in their new macbooks, freshly ruined by new ransomware, utterly baffled that it was possible at all. But when you're trying to use Photoshop without paying... well, shady stuff's still out there.
- lukan 1y ago
  But you also browse the web. Running lots of unvetted software. All safe, as long as the sandbox holds.
scarface_74 1y ago
And the other 80%+ of the population that uses Windows?
thebruce87m 1y ago
I’ve never needed the seatbelt in my car or the airbags but I will not be uninstalling them.
BLKNSLVR 1y ago
Same with me for Linux, but I would also say that, with the discipline and knowledge I have had for the last 10-15 years I probably wouldn't need anti-virus for Windows either.
- thebruce87m 1y ago
  Discipline and knowledge cannot protect against 0-click attacks.
  - rcxdude 1y ago
    antivirus won't generally do much for those either.
    - thebruce87m 1y ago
      If your system is infected you may know after the fact, which is better than never knowing.

You have been lucky. It's trivial for someone to write a stealer and trick someone to run it. For example there's been stealers targeting Linux built into trojans of Minecraft mods.

aquariusDue 1y ago
As another lucky soul do you happen to know of a case documented somewhere?
- charcircuit 1y ago
  For example. https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool https://support.curseforge.com/en/support/solutions/articles...
  - aquariusDue 1y ago
    That is wild, the numbers are much bigger than I expected. Thanks for sharing!

pjmlp 1y ago

Many people also never need insurances, until they do. How is that curl https://... | sudo sh going?

saagarjha 1y ago
Given its prevalence, I think it's actually going surprisingly well
- mike_hearn 1y ago
  Only if you ignore the "npm install" or "pip install" moral equivalent. Free open source packages that come with a side helping of malware have become common in recent years.
  - saagarjha 1y ago
    Oh I included that I just think that statically things are mostly going fine (unless we are all secretly backdoored in a way that has yet to be made public).

mike_hearn 1y ago

Macs come with an Apple provided antivirus built in, it's called XProtect. Apple also has enforced a similar policy to what Google is doing, but much stricter, and has done for ~13 years or so (devs must be identified, the OS rejects unsigned code in all territories by default, Apple pre-approves all binaries even outside the app store). Linux distros have policies far more extreme than anything Google, Apple or Microsoft have ever done. They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone, reject it for any reason or no reason at all (including reasons like "we don't have time"), and they tie getting new releases of your app to the user upgrading to new releases of the OS. If you do try and install stuff from outside of your distribution, not only are there security warnings to click through but an expected outcome is that the OS breaks and the vendor washes their hands of you. Despite those policies, or perhaps because of them, botnets of Linux servers are common. Of all consumer-facing platforms only Windows and Android allow installation of unsigned third party code out of the box via some obvious graphical path. And on Windows that right is somewhat theoretical. You can do it but the built in browser will try very hard to stop you, and the OS itself will happily break unsigned code by blocking file open syscalls heuristically. So in practice most apps don't go the unsigned route. On Android OTOH, unsigned (non ID verified) code is sandboxed and works just like regular apps after installation, the OS won't heuristically interfere with the app.

BLKNSLVR 1y ago
That's an interesting take on Linux. I see it as a lot closer to what Windows programs were like back in the day, where you can install whatever you want. Linux distributions each have their built in package managers, but there's no 'policy', as I understand it, that prevents installation of, literally, whatever you want. It's generally more difficult than just downloading and double clicking on the installer / exe, but just follow the instructions and it's done. And, yes, also there are weird version and dependency issues that crop up more than would be ideal, but that's not the topic.
- mike_hearn 1y ago

zeta0134 1y ago

Never in those 20 years did I need one on Windows either. It turns out if you vet the software you install in the first place, malware is pretty rare. That isn't the bar for most regular users of software though. Working in retail tech support, we got folks bringing in their new macbooks, freshly ruined by new ransomware, utterly baffled that it was possible at all. But when you're trying to use Photoshop without paying... well, shady stuff's still out there.

lukan 1y ago
But you also browse the web. Running lots of unvetted software. All safe, as long as the sandbox holds.

scarface_74 1y ago

And the other 80%+ of the population that uses Windows?

thebruce87m 1y ago

I’ve never needed the seatbelt in my car or the airbags but I will not be uninstalling them.

BLKNSLVR 1y ago

Same with me for Linux, but I would also say that, with the discipline and knowledge I have had for the last 10-15 years I probably wouldn't need anti-virus for Windows either.

thebruce87m 1y ago
Discipline and knowledge cannot protect against 0-click attacks.
- rcxdude 1y ago
  antivirus won't generally do much for those either.
  - thebruce87m 1y ago
    If your system is infected you may know after the fact, which is better than never knowing.