Not OP but - Windows is being bombarded by malware every second of every day. Linux, with its 6% of desktop user market share - not so much. This kinda’ guarantees Windows has a pretty good resilience (these days).
On top of that - in Linux you can change/break anything, which means bad actors could have you run malware by posting “helpful” comments on help threads. You know, “just run this .sh with sudo”.
Then you have situations like Arch has been going through - DDOS attacks on official repos and malware injected into a couple of packages in AUR. Sure, it got caught - but how many users installed the malware? How many other packages are under less scrutiny and are still serving malware in AUR?
And, I’m certain, someone out there is reading this and preparing to write a hot take on how “AUR is what it is, you’re not supposed to blindly install stuff from it” - but that’s exactly the problem. Because 99% of users have no clue what they’re doing.
Windows is being bombarded by malware every second of every day. Linux, with its 6% of desktop user market share - not so much.
Linux dominates the server space. Basically any company with access to lots of capital or trade secrets is running Linux servers. It is a massive, massive opportunity for hackers to hit jackpots. Linux gets bombarded by attackers constantly and holds steadfast. I’m not sure where you get this idea that this isn’t the case…
Edit: Just to really drive this point home, 65% of Microsoft Azure servers are Linux. Let that sink in, the majority of even Microsoft’s cloud servers are Linux. That is the one company you would think would be pushing Windows, yet here they are talking about their high quality Linux offerings!
“With over 65% of Azure workloads running Linux, our commitment to delivering high-quality Linux VM images and platforms remains unwavering.” - Microsoft
But the discussion is about user-space. Not everything from server-Linux translates 1:1 into desktop-Linux.
For example, there are no anti social engineering security measures in Linux. Just sudo and break anything and everything. Whereas on Windows, if you try doing something stupid, most probably Windows won’t let you, or will at least make you jump through some hoops.
They’re very much not, that’s the point. There are things that require the NT AUTHORITY\SYSTEM account permissions. Admin can do a lot in Windows, but not everything.
EDIT: also, Windows throws the UAC prompt around much less than Linux asks for the root permissions. ANY software update on Linux needs root. Even regular users are starting to get that if they see the UAC prompt, something big is about to happen.
You do have a point—Linux does not warn users against running superuser commands constantly and naggingly. Also not the beginner-friendly distros like Zorin, Mint and Ubuntu (as far as I know).
To me that’s fine, because I know not to just run any command, but my grandma who gets an email from a trustworthy-sounding person telling them to run “sudo install this keyboard logger and Rustdesk scripted installer” will not know better.
So then that begs the question, given you seem to know something about it: how should this be addressed? (I assume you know something about this—I don’t even know what an UAC prompt is.)
Not OP but - Windows is being bombarded by malware every second of every day. Linux, with its 6% of desktop user market share - not so much. This kinda’ guarantees Windows has a pretty good resilience (these days).
On top of that - in Linux you can change/break anything, which means bad actors could have you run malware by posting “helpful” comments on help threads. You know, “just run this .sh with
sudo”.Then you have situations like Arch has been going through - DDOS attacks on official repos and malware injected into a couple of packages in AUR. Sure, it got caught - but how many users installed the malware? How many other packages are under less scrutiny and are still serving malware in AUR?
And, I’m certain, someone out there is reading this and preparing to write a hot take on how “AUR is what it is, you’re not supposed to blindly install stuff from it” - but that’s exactly the problem. Because 99% of users have no clue what they’re doing.
Linux dominates the server space. Basically any company with access to lots of capital or trade secrets is running Linux servers. It is a massive, massive opportunity for hackers to hit jackpots. Linux gets bombarded by attackers constantly and holds steadfast. I’m not sure where you get this idea that this isn’t the case…
Edit: Just to really drive this point home, 65% of Microsoft Azure servers are Linux. Let that sink in, the majority of even Microsoft’s cloud servers are Linux. That is the one company you would think would be pushing Windows, yet here they are talking about their high quality Linux offerings!
“With over 65% of Azure workloads running Linux, our commitment to delivering high-quality Linux VM images and platforms remains unwavering.” - Microsoft
But the discussion is about user-space. Not everything from server-Linux translates 1:1 into desktop-Linux.
For example, there are no anti social engineering security measures in Linux. Just
sudoand break anything and everything. Whereas on Windows, if you try doing something stupid, most probably Windows won’t let you, or will at least make you jump through some hoops.Windows gives you a UAC prompt or needs one to run a cmd prompt as admin, both of which are functionally the same as sudo…
But, to circle back to the core statement. Yes it is. And Linux holds steadfast.
They’re very much not, that’s the point. There are things that require the
NT AUTHORITY\SYSTEMaccount permissions. Admin can do a lot in Windows, but not everything.EDIT: also, Windows throws the UAC prompt around much less than Linux asks for the root permissions. ANY software update on Linux needs root. Even regular users are starting to get that if they see the UAC prompt, something big is about to happen.
You do have a point—Linux does not warn users against running superuser commands constantly and naggingly. Also not the beginner-friendly distros like Zorin, Mint and Ubuntu (as far as I know).
To me that’s fine, because I know not to just run any command, but my grandma who gets an email from a trustworthy-sounding person telling them to run “sudo install this keyboard logger and Rustdesk scripted installer” will not know better.
So then that begs the question, given you seem to know something about it: how should this be addressed? (I assume you know something about this—I don’t even know what an UAC prompt is.)
Thanks for the summary!
If you want a bit more, also on security, check this comment.