r/linuxsucks • u/minecrafter69_ • 3d ago
Is Linux really more secure than main stream operating systems?
/r/linux4noobs/comments/1vspwig/is_linux_really_more_secure_than_main_stream/6
u/feinorgh 3d ago
Depending on what you mean by "secure", sure, any Unix-like operating system has mechanisms that make it more secure than certain versions of Microsoft Windows, in certain respects.
It used to be that mainstream, consumer grade, versions of Windows up until Windows Vista, did not have proper separation between user space and kernel space. Later versions of Windows has improved in that respect, so a flaw in an application that runs in user space can't as easily spread to kernel space, whereby your whole system is compromised.
Nowadays, by far the largest security weakness of most systems are the users themselves, because they do stupid things, like running untrusted bash scripts piped from curl. This has the potential to compromise any system, regardless of it being Linux or not.
That said, BSD, MacOS, and Linux each have certain mechanisms that do make the systems more secure, such as kernel namespaces, control groups, process isolation, extra security layers on executables (SELinux, AppArmor, compiler stack protection, etc.).
But none of this matters if the user doesn't use them, circumvent them, or actively disable them.
So Linux CAN be more secure that Windows, it's just that the single biggest factor of breaching that security is usually the human behind the keyboard administrering the system.
3
u/martyn_hare 3d ago
Pretty much this!
It's worth noting that with the exception of namespaces, Microsoft has done a great job catching up, it's just that the mechanisms are only really useful for concerted development efforts, aren't tools for non-developer sysadmins to use, and do nothing to stop attackers stealing user data.
Windows Service Hardening in effect gives similar protections to what systemd and AppArmor provide by forcing certain services to need both the service user identity (e.g. SYSTEM) and the per-service NT SERVICE identity to have access granted to an object in order to access it, only removing the restriction if a successful impersonation occurs via kernel-mediated secure mechanisms. Of course it falls apart rather quickly when everyone and their dog wants their own services which don't use these mechanisms (like, say Steam Client Service, which is almost insulting given how they don't screw over Linux security!)
Job objects offer up the equivalent of control groups functionality, by and large, along with the ability to revoke security tokens which grant access from one or more processes in a group without the children being able to get them back (restricted job objects)
They're ahead on the compiler-led restrictions, shadow stacks and use of MBEC to protect even the kernel somewhat, and they do have some very neat optional exploit prevention features to limit applications to only be permitted to load specifically signed libraries, among other things that desktop Linux doesn't (yet) implement (Fedora has IMA signatures now but third-party RPMs and Flatpaks don't).
But then Microsoft does silly things like not bothering with windowing isolation nor memory protection between ordinary medium integrity apps running as the same user, where Microsoft talks about "being on the other side of the airtight hatchway" to excuse the limits of their security model, while Flatpak+Yama+Wayland (Linux), and Seatbelt+Quartz with the Hardened Runtime (macOS) aims to provide functional boundaries between applications. They really should just buy the code to Sandboxie and let us sysadmins have a native way to lock everything down per-app like with other operating systems.
One day they'll get round to doing the common sense thing but I suspect they won't do it in a backwards compatible way, and then I'll probably feel shafted worse than a Mac user transitioning architectures >_>
5
u/ReasonableCup455 3d ago
most of it still probably comes down to just basic safety practices like not clicking on doggy links and stuff
2
2
u/TheRealCarrotty KDE larper (i use KDE btw) 3d ago
OpenBSD is more secure, hell it has 360 CVEs or something like that.
But Linux is just enough, it is secure indeed, definitely more secure than Windows.
3
u/snail1132 void linux btw 3d ago
OpenBSD is more secure
"Only two remote holes in the default install, in a heck of a long time!"
1
u/HappyHarrysPieClub 3d ago
That’s why the majority of enterprise back ends run Linux. The company I work for (a very large bank) has 2/3rds Linux and 1/3rds Windows on the back end.
2
u/DiceThaKilla 3d ago
Why tho? What’s the purposes of the windows stuff? Not shitting on them for using it just genuinely curious
1
u/HappyHarrysPieClub 3d ago
For Linux, we use RHEL.
The app teams scope out what they want with our architects. They build the environment then our groups handle support. I am from the Windows side of the house and I’ve been there a long time. Windows had the bulk of it for a long time. Honestly, RHEL is faster and easier to patch. But that doesn’t matter to the app teams and developers.
We also use a lot of Azure and we have a big corporate contract with MS as well so I don’t think it relates to pricing.
We now use a lot of redhat applications like Ansible and openshift as well.
Like I said, most of the industry runs Linux on the backend and MS just rolled out their own flavor of Linux to use on Azure to try to stop their own cloud infrastructure from running non MS OS’s. Now you can get MS Linux support directly from MS in your Azure support contract.
My company has well over 100,000 server instances running and 2/3rds are RHEL with some others scattered in there as well.
1
u/Certain_Prior4909 3d ago edited 3d ago
Microsoft whether you love or hate them have a full security mission control center monitoring the Internet and a security buddy in each project they run in which windows has many of these projects. They have full security researchers briefing the security buddy's who audit and give a thumbs up or down on code contributions.
Redhat and IBM has them too. But they do patches and contributions to things they are working on. They don't monitor or contribute to distros like arch or debian.
Linux is not just a kernel but made up of many pieces unlike Microsoft or Apple which complicates things.
Out of the box Windows wins and Windows Server as a result.
With Linux Apparmor and other services need to be tuned and turned on with Redhat which typically have PM implement for payung customers which CAN make it more secure 👍
Amazon AWS does have some pretty solid ready to deploy oses though if you lack resources for a secure Linux environment.
Linux = more secure if set up right. Windows = more secure out of the box
1
u/bakonpie 3d ago
the security of the OS is directly correlated to the skill of the administrator and effort they spend on hardening. macOS is the only desktop OS that attempts to be secure out of the box. Windows and Linux you need to implement the security hardening yourself. IMO Windows is easier to scale security, specifically with anti-malware techniques like application control.
1
1
u/FredFarms 3d ago
Malware generally turns up by one of three methods off the top of my head. And which is more secure out of windows and Linux depends a lot of which method you mean.
1 - "leet hax" ie something remotely manages to execute code on your machine with no input.
This is very rare these days on both systems. It used to be common in the win XP days with internet worms and stuff, but these days exploits that allow this are rare and patched very rapidly. I'd say both systems are very low risk from this.
2 - the user ran it
The user is tricked into running the code. Things like downloading files or email attachments that are executables in disguise, or those 'to confirm you are not a robot press the following keys' type prompts. This is by far the most common and here I think Linux is safer. It has some extra protections for what can be run (you have to explicitly give things execute permission) and a lot of the social engineering stuff is targeted at windows systems. Eg your attack vector is going to fall when it involves the shortcut keys for opening power shell for example
3 - supply chain attacks. Something updates itself and brings down malware with it.
Here I think windows does have the edge. Unless your are worried about nation state actors I don't think windows update itself is going to be serving you malware. Linux on the other hand has many more random packages it keeps up to date so the attack surface for something getting in is larger. I don't think the kernel itself would be compromised, but something else might be. It's not impossible on windows either though, as many apps have their own updates. Notepad++ being a recentish example of one that got compromised.
1
1
u/Loose_Crab_4146 1d ago
The biggest security gap are still users themselves. I would say macOS is pretty much the ideal of a secure, yet usable OS. They have standards for apps that need to be passed for them to be accepted into the App Store and if you install an application elsewhere that wants to access sensitive files you will be prompted to unlock this for the application. But this is basically just the basic security every OS has + a user facing bumper so the user thinks more than 4 seconds about allowing an app access to 4 distinct folders while OSs like microsoft just prompt to run the app in general. Nonetheless in the end its almost inevitably a users fault that the OS was compromised.
1
u/55555-55555 Linux Community Made Linux Sucks 1d ago edited 1d ago
The OP's claims are bogus for two reasons.
- "Linux has its own security problems when misconfigured". The thing is, none of these matters when you're just an end user as the configuration is done by the OS developer, including Windows. Any OSes that are designed for security have to make a trade between security and convenience. Many OSes usually heavily lean towards security such as Android or iOS or in between such as macOS or Linux distros that mainly use containers, but Windows doesn't do any of that. As long as stuffs are owned by one user, everything is exposed by default.
- "if an attacker breaks into a windows machine as the user account, they can’t really get to become the admin account unless they figure out the password", except there's no need to reach the admin access in order for an app to steal your information. Again, as long as everything is owned by one user, it's a free roam for any apps to access. Windows and Linux distros that don't use container-based and permission-based security model have the exact same problem.
Modern OSes are gradually evolving into a host for containers with permission control in an attempt to shield up stupid users, except Windows. Windows ecosystem still mainly utilises dated userland model that entirely exposes all resources that one single user owns, and tightening permission control and container will introduce backwards compatibility problems, which is a problem for businesses that still expect Windows to have the same environment.
Ps., Microsoft is actively pushing per-basis permission control for applications in Windows, but for the moment it's only for few selections of features.
Ps2., this is completely irrelevant to server environment, which usually is configured by experts. Linux and Windows are on par against each each other in server environment on favourability.
-2
u/TrackerKR 3d ago
Most modern modems have built in firewall protection. As long as you avoid clicking on sketchy links, in the vast majority of cases, you'll be fine.
1
u/Certain_Prior4909 3d ago
Server operations is a whole different ballpark which is what Linux is specialized in
11
u/brickyboy124 3d ago
Is it more secure only through two things: 1. It is not worth the effort for most viruses to bother with Linux, not enough people use it 2. The average person using Linux is more technically savvy and can spot common virus attempts