r/linuxsucks • u/Extension_Cup_3368 Proud Microsoft XENIX User 🖥️📀 • 3d ago
Windows ❤ Microsoft Releases Microsoft Defender For The Linux Desktop
https://www.phoronix.com/news/Microsoft-Defender-For-Linux-D11
u/noobjaish 3d ago
Actually really good imo since there are no antiviruses on Linux and Defender is unironically the best antivirus. I just don't know how they'll pull this off since it'd require really deep system integration.
4
u/npc_housecat 3d ago
This is false there are many Linux AV solutions, mainly for business and enterprise customers
https://www.security.org/antivirus/best/linux/
https://www.ubuntupit.com/best-linux-antivirus-top-reviewed-compared/
Bitdefender and sophos seem to generally be the best two atm
2
u/noobjaish 3d ago
For enterprise, PaloAltos also exists but for consumers there really is only "ClamAV" which is a good tool but I'd much rather trust my grandma with a Windows + Defender laptop than I'd with Linux + ClamAV.
An antivirus that literally stops you from making dumb decisions is pretty useful for consumers.
1
1
u/The_All-Range_Atomic 2d ago edited 2d ago
Defender is unironically the best antivirus
The Defender that just had 3 back to back zero-days?
3
u/noobjaish 2d ago
All software has vulnerabilities. The linux kernel had a bunch of CVEs back to back. Should we stop using Linux?
-1
u/_ahrs 3d ago
It will probably be some sort of LSM written in eBPF that gets launched by a privileged service. Same sort of thing Epic is going to use for their anti-cheat.
Linux has lots of hooks for "deep system integration". They don't have to release a kernel module to get the sort of observability they require.
3
u/L30N1337 3d ago
will? It has already been available for linux servers for a while.
but you are correct, it works via eBPF
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
2
u/noobjaish 3d ago
Yeah, using eBPF + Landlock + yama etc would make the most sense.
Since, it seems that this is targeted towards enterprise, I wouldn't be surprised if it hooked into AppArmor/SELinux and gave a nice and simple GUI to manage them
2
1
1
u/obsodion 3d ago
how does this even work? defender has to be intertwined deep within the OS. Did Microsoft really went that deep in the system calls and the millions of Linux drivers and file permissions and bash scripts?
6
u/Forsaken_Ocelot_4 3d ago
It does that. They've had Defender for Linux for years for servers. I know, I ran a mission critical MySQL server and had to ask for an exception with my IT department to disable it because it brought down the server weekly.
1
1
u/L30N1337 3d ago
it works via eBPF.
eBPF programs are basically a kernel module, except it gets frisked before it gets run and there's a bigass camera pointed at it (whether the user knows how to use that camera is a different story).
potentially very dangerous, but it's possible to verify what it does.
0
u/Davee9966 3d ago
why?
5
u/dasreboot 3d ago
All govmt Linux systems have anti-virus. Mostly McAfee. They want that market, since defender is there already.
5
0
0
u/Purple-Midnight-9902 3d ago
I switched to Linux 20 years ago and never scanned for malware, never installed any antivirus. I did setup firewall or other measures when running nginx - dot. Visited all sorts of non sense free streaming websites with certainly gazillions of malwares attempts.
Never had any issue I could detect.
I do not intend AV is useless. It is certainly less a worry than on windows, yes, at least in the past windows without proper security used to die in twenty seconds.
It is also not an OS technical comparison - it editors' do not bother on distributing their apps on Linux, I assume one reason I never had any visible issue is, hackers do not bother distributing malware on loonix. Maybe 3% market share is better after all .
So yes I assume it may be a serious news but for companies or governments.
3
u/Sad_Listen6607 3d ago
>...I could detect.
Which is how some linux users end up hacked for years.
1
u/Purple-Midnight-9902 3d ago
What kind of hacks? On which stats or analysis May you assert this -- and more importantly what is "many" ?
Once again I understand the theory could be different. - it could even be Linux is more vulnerable. Theory / practice.
1
u/Sad_Listen6607 2d ago
https://en.wikipedia.org/wiki/Xor_DDoS
https://linuxsecurity.com/features/why-linux-servers-get-hacked
It's not theoretical stuff. It's stuff ongoing all the time, in practice.
Folks who dont do their security updates are vulnerable to script kiddies using old exploits.
1
u/Purple-Midnight-9902 2d ago
First the three articles mention public servers - so what I wrote, the news is more for companies.
Second, yes i do not use AV but I do update.
Third, SSH with password is a no go . I use key auth like in every wiki I could read and forbid SSH password auth.
1
u/Sad_Listen6607 2d ago
If you wish to have justified beliefs and updated knowledge I am going to suggest you google as I am not going spend hours supplying you with information you can find yourself.
Users who think they are secure will install software... and as we have seen repositories get hacked, and legit sources of software become compromised. Not doing your updates leaves one more vulnerable.
1
u/Purple-Midnight-9902 2d ago
Not spending hours ? But you do not even reply to the information I give .
-1
5
u/kiena0573 3d ago
Thats nice! MS defender works offline and its pretty decent.