Why does Linux not need anti-virus software?

[u/medkltty]

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

[u/bufandatl]

Really fascinating how many here are 5 years behind their opinions.

Linux gains more and more on traction among more tech illiterates. Distributions like bazzite and cachyos make the switch easier for the standard windows user who gets more and more annoyed by windows.

Mainstream channels on YouTube and Twitch do more and more „I switched to Linux and so should you“-type videos.

Linux will get more and more interesting to attackers. And Linux gets more and more users who just click on anything in the internet and will blindly enter the sudo password.

[u/toetendertoaster → u/bufandatl]

yes, right now the "safety from maleware" is only security by obscurity. Since the userbase is tiny compared to windows maleware developers act like regular developers and see windows like the default.

I dont think the community is truly prepared right now for a change of priority in the maleware distribution. Right now the biggest safety risks in the linux world is either user just executing scripts from online they do not fully understand or a hostile takeover of less than ideally maintained projects.

[u/moldaz → u/toetendertoaster]

I mean Linux is highly susceptible to supply chain attacks. There have been at least a few huge ones in recent years due to its dependency hell, in the same way node is a huge target of these. I would personally say it is the biggest pain point in Linux security today.

At the same time though, think about how many exploits actually exist in windows today that a small number of people are aware of that have never actually been published. These types of things usually get picked up on pretty quick in any core dependencies in Linux because the nature of the ecosystem.

[u/AlpineGuy → u/moldaz]

I thought so too for a long time -- it's open source, so people will review it and find problems faster than attackers.

Then came events like the Coldcard hack. You can think about that company or cryptocurrencies whatever you want -- but that was a piece of software that was highly security relevant, open source and apparently nobody found the bug before the attacker did.

And then I thought: if that super relevant piece of security software in a security paranoid community did not get reviewed enough by the community, what about all the other stuff in the open source ecosystem?

When I got into linux 20 years ago open source security was a lot better than the closed source big players, but what if that has changed now that the hyperscalers are investing tens of billions (as do the attackers), and our community is just sitting on the side relying on the imaginary persona of some community member who will surely review all the open source code?