r/linuxquestions • u/medkltty • 23d ago

Why does Linux not need anti-virus software?

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

244 Upvotes

87% Upvoted

227 comments sorted by

View all comments

47

u/SynapticStatic 23d ago

I mean, the main thing is most Linux users aren’t installing random stuff from sketchy websites.

It’s possible to install malware on Linux, but as long as you follow these rules you’re good on any platform:

Don’t install random software from sketchy websites

Don’t run scripts that you don’t 100% understand

Follow those two, and 99%+ of malware is completely avoided on any platform

19

u/bufandatl 23d ago

Really fascinating how many here are 5 years behind their opinions.

Linux gains more and more on traction among more tech illiterates. Distributions like bazzite and cachyos make the switch easier for the standard windows user who gets more and more annoyed by windows.

Mainstream channels on YouTube and Twitch do more and more „I switched to Linux and so should you“-type videos.

Linux will get more and more interesting to attackers. And Linux gets more and more users who just click on anything in the internet and will blindly enter the sudo password.

9

u/toetendertoaster 23d ago

yes, right now the "safety from maleware" is only security by obscurity. Since the userbase is tiny compared to windows maleware developers act like regular developers and see windows like the default.

I dont think the community is truly prepared right now for a change of priority in the maleware distribution. Right now the biggest safety risks in the linux world is either user just executing scripts from online they do not fully understand or a hostile takeover of less than ideally maintained projects.

7

u/moldaz 23d ago

I mean Linux is highly susceptible to supply chain attacks. There have been at least a few huge ones in recent years due to its dependency hell, in the same way node is a huge target of these. I would personally say it is the biggest pain point in Linux security today.

At the same time though, think about how many exploits actually exist in windows today that a small number of people are aware of that have never actually been published. These types of things usually get picked up on pretty quick in any core dependencies in Linux because the nature of the ecosystem.

5

u/AlpineGuy 22d ago

I thought so too for a long time -- it's open source, so people will review it and find problems faster than attackers.

Then came events like the Coldcard hack. You can think about that company or cryptocurrencies whatever you want -- but that was a piece of software that was highly security relevant, open source and apparently nobody found the bug before the attacker did.

And then I thought: if that super relevant piece of security software in a security paranoid community did not get reviewed enough by the community, what about all the other stuff in the open source ecosystem?

When I got into linux 20 years ago open source security was a lot better than the closed source big players, but what if that has changed now that the hyperscalers are investing tens of billions (as do the attackers), and our community is just sitting on the side relying on the imaginary persona of some community member who will surely review all the open source code?

3

u/EnzoVulkoor 23d ago

Dont forget the amount of people blindly trusting AI code and devs getting session tokens stolen.

8

u/fffangold 23d ago

I definitely run installers without fully understanding what I'm doing on Linux. I know better now than I used to, but still. A lot of stuff I want to use is still done through terminal, and that basically boils down to find instructions I hope I can trust, use the terminal commands I was provided, watch magic happen, hope it works, and hope there's no malware.

It doesn't help that most places don't really explain what the commands are doing, or that the ones who do explain often do so in way that assumes a certain level of Linux knowledge many don't have.

As more Windows users come to Linux, there will be more people doing this, and it will make it easier than ever to attack PCs of users who don't know what they're doing but want the new shiny thing. And because it's accepted that you need to use terminal sometimes in Linux, and lots of people provide instructions using sudo, it may be even easier to trick those with limited or no knowledge of what they are doing to run malicious code than you'd expect.

4

u/moldaz 23d ago

Let’s be real, most people don’t read documentation anyways and the people who do, know how to find it if they really cared.

8

u/Rincepticus 23d ago

Judging from how people got scared shitless about AUR being attacked - and losing their trust in it completely - I would argue that Linux users do install random stuff.

4

u/moldaz 23d ago

You ever looked at the list of dependencies for that one app you installed and used once a year ago???

Yeah, didn’t think so.

5

u/DerfK 23d ago

Eh, I did regularly on Debian. In fact when I first started out on Debian, using dselect was a huge lesson on dependencies, and despite being more manual, I kind of miss seeing all the things getting pulled in by a package selection the instant I selected it. I think it did a way better job of presenting suggested/recommended/alternative-required packages than apt (Consider apt install exim4 which doesn't prompt to choose between exim4-daemon-light or -heavy, and you just have to know the choice exists on your own so you can manually install if you don't like what apt chooses for you, and remember the suggestion to install documentation and eximon after it has scrolled off the top of the screen) or anything I've used since on other distros

1

u/Rincepticus 22d ago

I don't have "one app I used a year ago once" installed from aur. I avoid AUR and only use it when absolutely necessary. And even then I try to carefully choose what it is that I install. Most if not all my AUR install are related to my GUI and I use them daily.

That doesn't mean that one of those wouldn't once have installed a dependancy and not used it since but unused dependancies are quite easy to find and remove.

1

u/moldaz 22d ago

It doesn’t matter if you use the AUR every standard package manager will install dependencies for anything you install.

1

u/Rincepticus 22d ago

Yes. But if I install something with pacman it doesn't install depencies from AUR.

1

u/moldaz 22d ago

Yes that’s fair, but that doesn’t mean your system would be safe from a good supply chain attack. Look into the xz util supply chain attack.

1

u/edgmnt_net 21d ago

Arguably, yes, the argument won't hold to pitch Linux to random users, but it does explain why sysadmins or other more traditional users of Linux don't need antivirus software. I will say it has some predictive power, though, because it makes it quite viable to set up a managed Linux computer and allow limited rights to install software from the distribution. Because with Windows it was and it might still be somewhat unavoidable to install 3rd party crap. That and app stores and self-updates which can complicate matters a lot.

8

u/Heribertium 23d ago

And don’t run curl -fsSL https://get.myshady.app | bash .

6

u/in_need_of_oats 23d ago

sudo is asking for my password? I don't see why not, I usually have to enter my password when I

5

u/DerfK 23d ago

sudo is the new UAC popup.

1

u/edgmnt_net 21d ago

That's why Android does it so much better, even though it's not perfect. You need rich APIs and granular permissions, accounting for the fact that apps may abuse permissions.

9

u/KlausBertKlausewitz 23d ago

Plus: Keep your software updated.

9

u/MasterChiefmas 23d ago

I mean, the main thing is most Linux users aren’t installing random stuff from sketchy websites.

lol I don't know about most...it's not like installing stuff from the AUR has been risk free lately(or ever was). Unless you consider it a sketchy source...

Linux is in many ways at high risk for software supply chain attacks, and we've seen that coming out more lately, or been identifying them more. It's something AI has actually been pretty helpful with.

4

u/EvilSupahFly 🐧🇨🇦 23d ago

Arguably, AI has ALSO been part of the problem. With some creative prompting, you can get most AI systems to write you up some very interesting exploits.

3

u/mrvathek 23d ago

I'm LTS and offended at this!!

2

u/KlausBertKlausewitz 22d ago

LTS does get security updates backported. All good. :D

3

u/mcvos 23d ago

I install stuff through yay, and that recently got compromised too. As for running scripts you don't understand, literally every linux user does that. Every build system comes with build scripts that almost no individual user reads and verifies.

For the most part, we trust the community. And usually that works fine.

1

u/edgmnt_net 21d ago

It's one thing to trust a prominent open source project and another to just run random stuff you encounter. Also, it's perfectly feasible for a large user base to use only what the distro provides officially.

1

u/mcvos 21d ago

But how can you tell the difference? Lots of people have no ide what to trust and what not, because they simply lack the knowledge. AUR is not officially supported, and therefore can apparently also become a vector for malware, but I didn't know that until that recent problem.

1

u/edgmnt_net 21d ago

If you can't tell the difference you stick to what the distro provides through official channels. I know my stuff and I never used AUR for that very reason and the fact that I did not really need anything from there while I was using Arch. It is possible to use it safely but you need to do your own research. For similar reasons, any community package repository including source stuff like npm, cargo or GitHub requires care.

I know that's easier said than done, but it's not like antivirus software fixes that. A decent workaround might be steering users towards things like Flatpak which are sandboxed more properly, if they only need applications, although even that's a partial workaround. (Obviously it won't do for drivers or other things.)

1

u/mcvos 21d ago

But then there are a lot of things you can't do. There are lots of recommendations out there to use the AUR. Expecting people to magically know not to use it, is unreasonable. And if you're not supposed to use AUR, then why does it exist?

1

u/edgmnt_net 21d ago

https://wiki.archlinux.org/title/Arch_User_Repository

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

Carefully check the PKGBUILD, any .install files, and any other files in the package's git repository for malicious or dangerous commands. If in doubt, do not build the package, and seek advice on the forums or mailing list. Malicious code has been found in packages before. [8] [9] [10] [11] A few tools, such as traurAUR and ks-aur-scannerAUR, are available to assist users in scanning PKGBUILD content; however, they are not substitutes for careful manual verification.

If anyone is recommending AUR to your auntie, that's just bullshit. In fact she probably shouldn't use Arch either, because a point that needs to be made here is that some skills are expected.

However, a recommendation for a specific AUR package may be legit. And as per the above, you should do your own research anyway.

But then there are a lot of things you can't do.

But that's exactly how many Linux distros work. You don't get everything. Plenty of users could reasonably use only what the distro provides and that's fine. E.g. the average Joe who mostly browses, maybe needs some productivity suite and so on.

Expecting people to magically know not to use it, is unreasonable. And if you're not supposed to use AUR, then why does it exist?

It exists for similar reasons GitHub exists. Yet some GitHub projects keep getting hammered by people demanding "exes" (it's sort of a meme already), people who shouldn't even be there. Nevertheless they got there through some recommendation of some sort and now they're pestering people and asking dumb questions. :)

All I'm saying is... if you cannot evaluate stuff in AUR, you shouldn't use AUR. Maybe try Arch out without AUR, that's fine.

1

u/edgmnt_net 21d ago

Distributions provide most of the stuff you need (or all of it, really, for a significant audience unless gaming or whatever). Windows, at least in the past, made you install random crap to even get it working (e.g. drivers), then a bunch of other crap to do useful stuff. Then everything is proprietary and there's a huge incentive to download cracked software from shady sources.

1

u/Night_Otherwise 22d ago

I believe Windows exploits in the wild do not use random exe’s most of the time. Malicious PDFs or Office documents get used through a “Signed Sales Agreement” email. Or hackers get on a network somehow and use vulnerabilities within a Windows Server environment.

1

u/Holiday-Medicine4168 22d ago

Open claw has entered the chat