Possible Duplicate:
Open Source vs Closed Source Systems
Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of reasons being you don't have to worry about using an anti-virus on Linux!!
What is the basis of this notion? And to what degree is it true?
Has this got anything to do with the Open-source nature of Linux? Its community support? Its underlying architecture (and the difference from Windows)?
I'm going to knock some of the bad notions here:
1) Linux is more secure because of less marketshare.
Not in the server market, where public machines get slammed by bots, viruses, hackers, etc. all day:
http://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Servers
2) Windows is more secure in recent versions.
At least at the kernel level, you're seeing more CVE reports of remote execution exploits and privilege escalation in Windows, more local DoS attacks to a multi-user environment in Linux, also you'll find more critical CVEs on Windows (I had a bunch of statistical breakdowns from a CVE database but I can't find that post I made months ago, so frustrating! Google isn't helping me find it...).
As you can see Server 2008 has a much higher weighted average of CVE severity:
http://www.cvedetails.com/top-50-product-cvssscore-distribution.php (plus, all Linux vulnerabilities from the 1.2 days vs the past 5 years of 2008 development!)
Of course you run with something like Ubuntu that comes with a bunch of software and pre-configuration on top of it, they're at the whim of the software running on it.
My opinion on the subject: Linux is built around a lot of Unix concepts, 40 years of software development and people beating these boxes to death, it is secure mainly by Unix's trial by fire, and this has helped immensely, lots of lessons were learned and directly applied to Linux.
Has this got anything to do with the Open-source nature of Linux?
A lot of it has to do with that, at least with the speed at which the higher volume of CVEs are addressed. This also allows a lot of smaller issues to be found and fixed (mainly due to it's popularity, because open-source with no popularity means few eyes on the code and little interest to fix).
Its underlying architecture (and the difference from Windows)?
Being built up around a multi-user environment helps a ton, these systems were built to have tons of people on them at once, and no one user should be able to interrupt another.
Valid Reasons:
Furthermore, somewhat debatable reasons you could argue that Linux often has a more secure design (that may not be so true any more as other OSes have played catchup).
su/sudo, that don't really exist in older versions of Windows.ssh. Your standard connection to another remote machine through ssh is very convenient and powerful, which is vastly superior to any windows remote authentication in terms of security. Whenever you connect to an ssh machine, you cryptographically check that the host key of the other machine hasn't changed from the previously used key; you can use your ssh private key to respond to a challenge token without letting eavesdroppers use replay attacks or keyloggers see your password. Then all traffic is sent encrypted between the two machines; furthermore its trivial to set up on a Linux box.Not valid reasons:
IMHO, there are 3 main reasons:
Leaving aside the first point, it's debatable whether Linux is intrinsically more secure than MSWindows (IMHO it is, but that's a rather long and boring argument).
Given that MSWindows now has better privilege seperation than it used to, it's interesting to note that there is a particular distribution of Linux with strong market penetration, used by the proletariate, and which has a very unusual approach to privilege seperation - which is attracting a lot of malware development effort - Android.
While I wouldn't recommend not running an anti-virus and firewall on a MSWindows machine, by far the most important thing you can do to keep your computer clean is to configure it properly and keep up to date with vendor supplied patches.
IMHO it is, but that's a rather long and boring argument Please. I'm listening.
Jun 1, 2020 at 6:49
I suspect that the virus/malware situation on Linux is pretty much what would be "normal", and that the virus/malware situation on Windows is a statistical freak, more of a "Dragon King" than a Black Swan.
Windows has an unusually baroque set of APIs, Win32, NT native API, on and on and on, and there have been some problems between them, like Win32 being basically an ASCII interface while NT native is Unicode. This has at least facilitated malware. As an example of a Rococo detail, think about the magic device file names, AUX, CON, LP that work in any directory.
The Windows native API has never really been documented, and this lack of documentation flows though to other things, such as: what set of file name extensions is for executable files? Why does the file name determine whether a file is executable or not? Didn't the NIMDA worm spread via some problem with ".eml" files, as an example. Nobody knew that .eml files were executable at the time.
Windows has no tradition of separation of privileges, indeed it has a tradition of single, root-user. Lots of applications still assume this. Windows has no tradition of separation of data from executables. I give you Word macros embedded in the .doc file as an example of un-separated data and instructions that have historically caused virus problems.
Linux has at least traditions opposite to all the above points: mildly effective discretionary access controls, simple enough to be applied on a day-to-day basis, yet comprehensive enough to keep traditional file-type viruses at bay. The system call interface is only moderately complicated, and since source code is freely available, multiple sources of documentation exist. Executables typically live in "bin" directories, and data lives in another. Each executable has its own configuration file, rather than sharing the big ol' Registry. Data files live in per-user directories, and almost never contain the kind of all-powerful macros that Word, etc, data files contain.
Also, "linux" doesn't really exist as "Windows" does. Hundreds of distros exist, each customizing almost every aspect of low-level details. Different compiler versions, different linux kernels, some all-modular, some without modules. That's true of virtually every software aspect of a system, from the kernel, to email clients. Where "Windows" users by-and-large use Outlook email clients, Linux users use an array of hundreds of different clients, each in tens of versions. There's no user base for any given version of any given piece of software: the user base is not just fractured, it's shattered. This makes it a lot harder to find a vulnerability on a suitable number of hosts, or to write an exploit that would work on a large enough number of instances of software.
I personally feel that this notion is due to the fact that Windows is far more widely used than linux. In addition, Linux is usually used in enterprise environments which should have better security than home systems and networks. This might contribute to the thinking that Linux is more secure than Windows.
Of course, both systems can be vulnerable if not configured properly and patched regularly. Both systems also has the potential to be secure if set up properly.
"Linux more secure than Windows" is not necessarily true, because Windows always ships as a complete operating system, while Linux has many distribution versions.
There are as many advanced security features in Linux as in Windows, but not every Linux distro is using them.
Some of these distros are highly secure and some are not - some do not enforce MAC or built-in reliable method caging by default.
Many current malware programs (virus, worm, Trojan, spyware) target windows based system, so there are more antivirus and antimalware applications for windows.
But if anybody wants to attack your Linux system, it is as easy to make harmful program using bash script as it is to use Windows scripting.
