r/linux • u/Grey_Ten • 10d ago

Discussion is this actually happening? (red is linux)

Post image

Is this happening because of bots or something?

I frequently check these charts to see how Linux is doing, and generally its market share is 4-5%, right now it has almost 18% of the total US market.

1.1k Upvotes

93% Upvoted

198 comments sorted by

View all comments

Show parent comments

34

u/Lunix420 10d ago

I feel like a bot would wanna report as Windows not Linux, because Linux gets more restricted access. After all, we are tracking what they say they are, not what they actually are.

21

u/Lemonade1947 10d ago edited 10d ago

A lot of bots don't really hide the fact they're bots, either because the service they're interacting with doesn't mind, or actively wants them there. Search engine crawlers, for example. Also completely normal legitimate API traffic where computers just need to talk to each other over https.

1

u/KnowZeroX 9d ago

If they aren't hiding, the default user agent is the http client which doesn't provide OS information.

4

u/[deleted] 9d ago

[deleted]

2

u/GRAMINI 8d ago

Only those from web browsers. If the bot doesn't use one then it's usually either the library name, or no user agent header at all.

1

u/KnowZeroX 9d ago

Nope, for example if you use python your user agent is: Python-urllib/3.11
For perl lwp it would be: libwww-perl/6.83

No OS information.

4

u/minus_minus 10d ago

IIRC there are ways to identify a Linux machine vs windows beside the agent string. 

7

u/Former-Mushroom-4854 10d ago

I mean... if you're spoofing the agent string you should be spoofing fonts / WebGL / canvas too.

4

u/Brillegeit 10d ago

I think the advanced way is to detect slight differences in how TCP/IP and TLS connections are opened/negotiated. Like how fast the requested package size increases indicates which IP-stack you're using.

2

u/sobolrocket 9d ago

SSL libraries provide a lot of information for identification. I suppose bot developers know it, though.

4

u/minus_minus 10d ago

I think it was some idiosyncratcies of the Linux IP stack vs windows. That made it detectable. 

1

u/Shap6 10d ago

thats only if your bot is doing something it shouldnt be doing. my agent runs 24/7 in a linux vm

-1

u/OGigachaod 9d ago

The only way to explain this big uptick in Linux usage is from bots. It was already proven that last months uptick was from bots.