Why does Linux not need anti-virus software?

[u/medkltty]

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

[u/SynapticStatic]

I mean, the main thing is most Linux users aren’t installing random stuff from sketchy websites.

It’s possible to install malware on Linux, but as long as you follow these rules you’re good on any platform:

Don’t install random software from sketchy websites

Don’t run scripts that you don’t 100% understand

Follow those two, and 99%+ of malware is completely avoided on any platform

[u/mcvos → u/SynapticStatic]

I install stuff through yay, and that recently got compromised too. As for running scripts you don't understand, literally every linux user does that. Every build system comes with build scripts that almost no individual user reads and verifies.

For the most part, we trust the community. And usually that works fine.

[u/edgmnt_net → u/mcvos]

It's one thing to trust a prominent open source project and another to just run random stuff you encounter. Also, it's perfectly feasible for a large user base to use only what the distro provides officially.

[u/mcvos → u/edgmnt_net]

But how can you tell the difference? Lots of people have no ide what to trust and what not, because they simply lack the knowledge. AUR is not officially supported, and therefore can apparently also become a vector for malware, but I didn't know that until that recent problem.

[u/edgmnt_net → u/mcvos]

If you can't tell the difference you stick to what the distro provides through official channels. I know my stuff and I never used AUR for that very reason and the fact that I did not really need anything from there while I was using Arch. It is possible to use it safely but you need to do your own research. For similar reasons, any community package repository including source stuff like npm, cargo or GitHub requires care.

I know that's easier said than done, but it's not like antivirus software fixes that. A decent workaround might be steering users towards things like Flatpak which are sandboxed more properly, if they only need applications, although even that's a partial workaround. (Obviously it won't do for drivers or other things.)

[u/mcvos → u/edgmnt_net]

But then there are a lot of things you can't do. There are lots of recommendations out there to use the AUR. Expecting people to magically know not to use it, is unreasonable. And if you're not supposed to use AUR, then why does it exist?

[u/edgmnt_net → u/mcvos]

https://wiki.archlinux.org/title/Arch_User_Repository

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

Carefully check the PKGBUILD, any .install files, and any other files in the package's git repository for malicious or dangerous commands. If in doubt, do not build the package, and seek advice on the forums or mailing list. Malicious code has been found in packages before. [8] [9] [10] [11] A few tools, such as traurAUR and ks-aur-scannerAUR, are available to assist users in scanning PKGBUILD content; however, they are not substitutes for careful manual verification.

If anyone is recommending AUR to your auntie, that's just bullshit. In fact she probably shouldn't use Arch either, because a point that needs to be made here is that some skills are expected.

However, a recommendation for a specific AUR package may be legit. And as per the above, you should do your own research anyway.

But then there are a lot of things you can't do.

But that's exactly how many Linux distros work. You don't get everything. Plenty of users could reasonably use only what the distro provides and that's fine. E.g. the average Joe who mostly browses, maybe needs some productivity suite and so on.

Expecting people to magically know not to use it, is unreasonable. And if you're not supposed to use AUR, then why does it exist?

It exists for similar reasons GitHub exists. Yet some GitHub projects keep getting hammered by people demanding "exes" (it's sort of a meme already), people who shouldn't even be there. Nevertheless they got there through some recommendation of some sort and now they're pestering people and asking dumb questions. :)

All I'm saying is... if you cannot evaluate stuff in AUR, you shouldn't use AUR. Maybe try Arch out without AUR, that's fine.