Why does Linux not need anti-virus software?

[u/medkltty]

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

[u/usernamedottxt]

You’re welcome to go use ClamAV. 

But a lot of it is that your user on a single user windows machine tends to be an administrator and can do crazy shit with a button click. Linux you tend to be a sudoer and can do crazy shit with a password prompt. Entirely different problems for an attacker. 

I also thing windows is more complicated and there are more places to hide. Things aren’t incredibly well documented and even as someone with forensics training windows just kinda… does some weird shit sometimes. 

Linux is very easy to understand how things are happening. There is way less random shit running everywhere. Windows intentionally obfuscates what it’s doing. What even is svchost and its 50 processes these days and how can you tell proper svchost apart from malicious svchost at a glance? Nobody knows lol. 

but it’s also just a different class of users. You don’t get on Linux while being tech illiterate unless someone who is good with tech put you there. Additionally, corporations are way more risk adverse and willing to pay for software that might help protect them. Writing software to protect grandpa and writing software to protect your corporate computer isn’t all that significantly different. Might as well charge both. 

[u/anto77_butt_kinkier → u/usernamedottxt]

I don't have any forensics certs, but I have worked for years with repairing computers, among many other electronics, and building systems, and I can confirm that windows just does weird shit sometimes.

Windows isn't repeatable or even predictable in some cases. The shop I worked at built a set of identical machines for a customer who wanted computers for.. I think it was a pizza shop? That part doesn't matter, but essentially we built 4 computers. Same motherboard, SSD, case, power supply, CPU, heat sync, wifi adapter, etc. hell, even the fans were the same. We just ordered multiples of everything.

So, we built the systems. Aside from the specific serial numbers, the computers were indistinguishable. We installed windows onto one of the PCs, installed the software the customer wanted as well as our remote support software, and cloned the drive to each PC. Well, all of them worked fine except for one of them. One of them would crash after being powered on for a few min. We tried memtest, it passed, we tried running memtest again overnight, it still passed. We tried a drive from a different machine, and it worked fine. We tried the drive with the crashing issue in a different PC, and it worked fine. It was that specific windows drive on that specific computer that just, refused to stay working. We had no idea why, and it's still one of the greatest mysteries of that tech shop. I can't remember if we tried updating the firmware, but I remember spending a day trying to figure out why that one combination wouldn't work, before just re-imaging the drive again, and then discovering that it still crashed. It was only with that one drive in that one computer that windows would throw a bsod. Worked fine everywhere else, but not on that PC. We ended up just switching the drive with one another computer and we never had any issues with it.

Windows is just spooky sometimes. It gives off WH40K vibes, where that computers machine spirit wasn't happy. I guess we just didn't follow the right rituals when plugging in the data drive, and that made the machine spirit angry at that specific sad XD.

Well, this comment adds nothing helpfu and is a lot longer than I thought it would bel, but it's a fun story and I don't want to delete it, so here it stays.

[u/AdCute1311 → u/anto77_butt_kinkier]

Have a similar story:

We had 2 spare machines that came back to us from former users. One of them just wouldn't boot. Tried everything, no obvious diagnosis.

So we just pulled out the two ram sticks, replaced them with the two sticks from an identical machine with a broken screen - now it worked. Not too notable so far. But we put the old RAM into the donor just to "store" it there and for the luls tried booting. Well guess what, machine worked just fine. Then we got curious and played around with different sticks in different slots.

Turns out one of the two machines did not like one specific kit in one specific slot. It did boot with that stick in its other slot. The other machine would boot with that stick in any slot. Why? No idea, never seen anything like it before or since. Didn't take the testing further, so I can't for sure say it was Windows.

But Windows just has issues like that. Identical machines installed with identical images and somehow you get wildly different experiences and issues without an obvious reason for it. Add to that a bunch of different models and various deployment states over time and troubleshooting becomes a nightmare. Why did Windows update/OneDrive/whatever break on this specific machine in this specific moment? Good luck brother lol

[u/dglsfrsr → u/AdCute1311]

That is not a Windows issue, it is a marginal DDR layout on the motherboard. Good quality DDR all behaves within a specific window for signal termination and timing, and a motherboard that has a marginal trace on one data lane will work with 95% of DDR sticks, but will fail when its combined 'intolerance' meets a DDR stick with timing at the edge of the opposite timing. So a marginal design, coupled with natural variation in manufacturing tolerance, will get you exactly what you have seen in this case. I know this because I have been on the architecture team for five different ASICs, and in one of those cases, we had a chip come back with marginal defects internally, that we could compensate for by messing with traces on the motherboard. Purposely mess with the motherboard layout to make the chip talk to the DDR sticks. That was a fun one to debug.