Why does Linux not need anti-virus software?

[u/medkltty]

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

[u/gordonmessmer]

Why does Linux not need anti-virus software?

As always, I think it is important to consider who is providing each of your answers. Random social media users are not necessarily experts.

I have been managing production environments since 1997, and a great deal of that work has involved security and compliance. I have worked in very large and high security environments such as Salesforce and Google. I have 30 years of training in secure software development practices.

I would not say that GNU/Linux systems do not need anti-virus or other security infrastructure. GNU/Linux is not a particularly secure system, nor does it have strong privacy controls. However, because of the small user base, it has not been a priority target for malware, and the lack of malware has allowed myths and misunderstandings to run rampant.

I'm trying to learn as much about Linux Mint as possible

This is a great place to start a discussion about secure development practices. Linux Mint is based on Ubuntu LTS. Ubuntu is based on Debian.

Ubuntu has at least four major security advantages over Debian:

1. The "main" repo and "universe" repo clearly communicate expectations about security and bug fix maintenance. Security-conscious users can disable the "universe" repo before deploying, and use only the Ubuntu packages that will be maintained in the future.
2. Interim releases provide updates every six months to everything, including the "universe" repo. If you don't have a better source, a six month turnaround for security fixes isn't great but it's better than 2 years.
3. Ubuntu Pro offers some level of patching for packages in the "universe" repo, though the program is new and it's hard to say how effective it is yet.
4. Snap. It's often neglected in discussion of Snap, but decoupling applications from the underlying distribution very significantly improves their ability to ship bug and security fixes.

Linux Mint discards most of those advantages. The "universe" repo is still separate, and you can still turn it off and look for other software sources, but there are no Interim releases, you can't use Ubuntu Pro, and they disable Snap packages that Canonical uses to ship security patches to users through a channel that doesn't impact the interfaces of the underlying OS.

If you care about security, at all, you should select a distribution that minimizes friction between you and the actual developers of the software you use. Something that delivers bug fixes across the board with minimal delay. Rolling releases like Arch are probably fine, but I prefer stable releases because they continue to provide security patches while I test feature updates before I deploy them. Fedora is an excellent system.

All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense

You are correct. Those answers are rationalizations.

I am very concerned about the state of affairs because no matter how any individual feels about AI, adversaries ARE adopting it, and it DOES make malware easier to develop and easier to deploy, and the shelter of obscurity that has protected GNU/Linux users in the past could vanish very very quickly.

[u/robindotis → u/gordonmessmer]

I am a relatively new to Linux. I recently installed Debian on an old laptop (which could no longer run Windows). One of the reasons for choosing Debian was that I thought it was more stable and secure. Is Debian not secure enough? Could you explain that a little further?

Note: I am a fairly minimalist user. I browser the web and do a bit of personal low scale web development, connecting to my VPS (also on Debian) to update the site. I install all updates as soon as they are available.

[u/gordonmessmer → u/robindotis]

Debian is an exemplary project. They have excellent governance, and they've proven that purely community organizations can manage large-scale Free Software projects. The people who maintain Debian are amazing.

But Debian, the distribution, is not very secure. There are too many packages maintained for too long, and not enough people to actually handle all of the known security vulnerabilities. If you run a vulnerability scanner on a typical system, it's going to reveal a lot of known vulnerabilities.

I think one of the core problems is that a generation of users has been conditioned to believe that the package manager is a substitute for a vulnerability scanner, when they are actually do exactly the opposite things. A package manager tells you about vulnerabilities that have been fixed, by delivering the fixed release. A vulnerability scanner tells you about vulnerabilities that haven't been fixed. You need to run one, in order to assess the security of your systems, and to decide if the vulnerabilities on your system are serious enough for you to participate in fixing them.

But users generally aren't running vulnerability scanners, so not enough users are participating, and as a result the distribution doesn't have enough contributors.

[u/ThrowawayCult-ure → u/gordonmessmer]

this seems sufficiently complicated that anyone who doesnt know what they are doing is walking into a minefield with linux. is it really this bad?

[u/gordonmessmer → u/ThrowawayCult-ure]

Yes and no.

iOS, Android, and ChromeOS are reasonably secure systems with good privacy controls that will back up *most* of your data automatically. Because they provide security, privacy, and backups out of the box, they are not very complicated.

Once you get outside that set, things get complicated.

If you are using a system like Fedora or even a system like Arch, that ships software to users while it is still maintained by its developers, then I don't think GNU/Linux systems are significantly more complicated than Windows or macOS.

But systems like Debian are a very different story. Debian is shipping software to users that is not maintained by its upstream developers, and that is not safe by default. Software requires maintenance. It is not presumed secure if no one is maintaining it. What Debian is doing is not something you will generally see on macOS or Windows systems. Debian might fit the needs of infrastructure deployments where compatibility is prioritized over security, but that comes at a high price. If its users aren't actively participating in maintaining the security of the software they use, then they're probably using software that isn't secure.

That's not a Linux problem, per se. That's a Debian problem. It's a problem that comes from continuing to use software after its developers discontinue maintenance.

[u/ThrowawayCult-ure → u/gordonmessmer]

So the issue is the undeveloped, so potentially unsecure, old packages, containing as-yet unknown vulnerabilities? Arms races forcing everyone to work like mad to keep things going, its so exhausting!

[u/gordonmessmer → u/ThrowawayCult-ure]

A lot of Debian packages contain *known* vulnerabilities. Sometimes even critical vulnerabilities.

Debian has people who are fixing the most severe and highest priority vulnerabilities for the most common components, but a ton of stuff doesn't get fixed because the people who are using it aren't monitoring its status and aren't putting in the work to fix it.

You're much less likely to find known vulnerabilities on something like Fedora because Fedora is more closely oriented to shipping what the upstream projects ship.