I’m still in the research phase of switching to Linux and don’t know if this concern is reasonable. I’m not tech savvy. I’m comfortable in the windows ecosystem and could use the dos prompt fine when they used it. I played with QBasic and C++ when I was younger and have built a few computers but that was a couple decades+ ago.
My concern is dealing with malware. I know that Linux has less issues with malware than Windows but, as I understand it, that’s primarily because it has a comparatively small market share. I feel like I’m getting into Linux just as it’s getting more popular and that it will get worse if the EU moves away from Microsoft because they will most likely adopt some form of Linux as their new standard. More less tech savvy people like me moving to Linux makes it a juicier target for people who create and use malicious software. It’s not a reason to stay with Windows but is it a reasonable concern? Are there sufficient tools for people who don’t really know what they’re doing to be reasonably secure on Linux and will they keep up if the threat profile expands as Linux picks up more users?
There’s a lot of misinformation in this thread. Linux malware targeted at desktop users has actually become more apparent in recent years due to the growing number of users.
That didn’t use to be the case because Linux was almost exclusively used for everything except end user desktops.
What you need to understand is Linux is fundamentally more secure from the OS perspective. A good example is how there are no network listening services running like how Windows has SMB/NetBIOS which had the infamous eternal blue vulnerabilities.
That means it is highly unlikely you will be targeted by system/service level malware that exploits known vulnerabilities, so long as you stay reasonably up to date with your package manager. Add on to the fact you probably won’t be running such software like Apache or NGINX anyways.
Yes, you should still stay vigilant as a user as current malware, even for windows, typically invovles some level of social engineering.
The bonus for linux is that you should optimally never have to download executables from the browser. Anytime you do, make sure to pay close attention to what you are downloading and where from.
Some key stuff for linux:
Never do a
curl | bash. Always download the script and peruse it to see what it actually does.Always prefer packages from package manager, and be careful if using 3rd party repos such as AUR or COPR
Don’t download binaries from untrusted sources, and never run as sudo without knowing what it does.
Yes, I suggest you become a little bit familiar with a distro that has SELinux (ex: Fedora). It’s just a MAC security control scheme, but it adds a lot of benefit if you aren’t familiar with Linux in general.
Aside from that, you can use ClamAV for virus scanning. AV and consumer EDR on Linux isn’t that widely available due to the low amount of malware at this time, but I do expect that to slowly change as the userbase grows.
As malware detection gets better, I’m sure ClamAV will add features and functionality to keep up.