Or we could say: security is a practice. Usually the design of an O.S. has certain weight, but not half of the weight that the operators (and users) have. A k

Or we could say: security is a practice. Usually the design of an O.S. has certain weight, but not half of the weight that the operators (and users) have. A keylogger for linux takes less than 30 lines of C... a payload for a root shell takes less... but to certify that they will work on every Linux out there... is more hard... it's hard even with constructive software, it shouldn't be less hard with malware. The concept of malware may vary too much from one person to other, from one company to other, from one project to other. It's not always a trojan, and software is a changing scenario. And it's not isolated, it's an ecosystem. First viruses did travel on floppy disks. Nowadays they use websockets, sql, or render themselves as a (web) image or font. Even the low latency 8.8.8.8 DNS, maybe considered malware if we go philosophical. Internet, as the real world, is something wonderful. And as the real world, may turn hostile. So even if wonderful, each one should take care on what to trust, and what not, and how. Update: remove all "quoting" as I was told once that I use them too much.