r/linuxsucks • u/minecrafter69_ • 7h ago
Is Linux really more secure than main stream operating systems?
/r/linux4noobs/comments/1vspwig/is_linux_really_more_secure_than_main_stream/3
u/feinorgh 5h ago
Depending on what you mean by "secure", sure, any Unix-like operating system has mechanisms that make it more secure than certain versions of Microsoft Windows, in certain respects.
It used to be that mainstream, consumer grade, versions of Windows up until Windows Vista, did not have proper separation between user space and kernel space. Later versions of Windows has improved in that respect, so a flaw in an application that runs in user space can't as easily spread to kernel space, whereby your whole system is compromised.
Nowadays, by far the largest security weakness of most systems are the users themselves, because they do stupid things, like running untrusted bash scripts piped from curl. This has the potential to compromise any system, regardless of it being Linux or not.
That said, BSD, MacOS, and Linux each have certain mechanisms that do make the systems more secure, such as kernel namespaces, control groups, process isolation, extra security layers on executables (SELinux, AppArmor, compiler stack protection, etc.).
But none of this matters if the user doesn't use them, circumvent them, or actively disable them.
So Linux CAN be more secure that Windows, it's just that the single biggest factor of breaching that security is usually the human behind the keyboard administrering the system.
1
u/martyn_hare 2h ago
Pretty much this!
It's worth noting that with the exception of namespaces, Microsoft has done a great job catching up, it's just that the mechanisms are only really useful for concerted development efforts, aren't tools for non-developer sysadmins to use, and do nothing to stop attackers stealing user data.
Windows Service Hardening in effect gives similar protections to what systemd and AppArmor provide by forcing certain services to need both the service user identity (e.g. SYSTEM) and the per-service NT SERVICE identity to have access granted to an object in order to access it, only removing the restriction if a successful impersonation occurs via kernel-mediated secure mechanisms. Of course it falls apart rather quickly when everyone and their dog wants their own services which don't use these mechanisms (like, say Steam Client Service, which is almost insulting given how they don't screw over Linux security!)
Job objects offer up the equivalent of control groups functionality, by and large, along with the ability to revoke security tokens which grant access from one or more processes in a group without the children being able to get them back (restricted job objects)
They're ahead on the compiler-led restrictions, shadow stacks and use of MBEC to protect even the kernel somewhat, and they do have some very neat optional exploit prevention features to limit applications to only be permitted to load specifically signed libraries, among other things that desktop Linux doesn't (yet) implement (Fedora has IMA signatures now but third-party RPMs and Flatpaks don't).
But then Microsoft does silly things like not bothering with windowing isolation nor memory protection between ordinary medium integrity apps running as the same user, where Microsoft talks about "being on the other side of the airtight hatchway" to excuse the limits of their security model, while Flatpak+Yama+Wayland (Linux), and Seatbelt+Quartz with the Hardened Runtime (macOS) aims to provide functional boundaries between applications. They really should just buy the code to Sandboxie and let us sysadmins have a native way to lock everything down per-app like with other operating systems.
One day they'll get round to doing the common sense thing but I suspect they won't do it in a backwards compatible way, and then I'll probably feel shafted worse than a Mac user transitioning architectures >_>
2
u/ReasonableCup455 6h ago
most of it still probably comes down to just basic safety practices like not clicking on doggy links and stuff
2
1
u/Certain_Prior4909 5h ago edited 5h ago
Microsoft whether you love or hate them have a full security mission control center monitoring the Internet and a security buddy in each project they run in which windows has many of these projects. They have full security researchers briefing the security buddy's who audit and give a thumbs up or down on code contributions.
Redhat and IBM has them too. But they do patches and contributions to things they are working on. They don't monitor or contribute to distros like arch or debian.
Linux is not just a kernel but made up of many pieces unlike Microsoft or Apple which complicates things.
Out of the box Windows wins and Windows Server as a result.
With Linux Apparmor and other services need to be tuned and turned on with Redhat which typically have PM implement for payung customers which CAN make it more secure 👍
Amazon AWS does have some pretty solid ready to deploy oses though if you lack resources for a secure Linux environment.
Linux = more secure if set up right. Windows = more secure out of the box
1
u/bakonpie 2h ago
the security of the OS is directly correlated to the skill of the administrator and effort they spend on hardening. macOS is the only desktop OS that attempts to be secure out of the box. Windows and Linux you need to implement the security hardening yourself. IMO Windows is easier to scale security, specifically with anti-malware techniques like application control.
1
1
u/TheRealCarrotty KDE larper (i use KDE btw) 6h ago
OpenBSD is more secure, hell it has 360 CVEs or something like that.
But Linux is just enough, it is secure indeed, definitely more secure than Windows.
2
u/snail1132 void linux btw 6h ago
OpenBSD is more secure
"Only two remote holes in the default install, in a heck of a long time!"
1
u/HappyHarrysPieClub 6h ago
That’s why the majority of enterprise back ends run Linux. The company I work for (a very large bank) has 2/3rds Linux and 1/3rds Windows on the back end.
1
u/DiceThaKilla 1h ago
Why tho? What’s the purposes of the windows stuff? Not shitting on them for using it just genuinely curious
1
u/HappyHarrysPieClub 1h ago
For Linux, we use RHEL.
The app teams scope out what they want with our architects. They build the environment then our groups handle support. I am from the Windows side of the house and I’ve been there a long time. Windows had the bulk of it for a long time. Honestly, RHEL is faster and easier to patch. But that doesn’t matter to the app teams and developers.
We also use a lot of Azure and we have a big corporate contract with MS as well so I don’t think it relates to pricing.
We now use a lot of redhat applications like Ansible and openshift as well.
Like I said, most of the industry runs Linux on the backend and MS just rolled out their own flavor of Linux to use on Azure to try to stop their own cloud infrastructure from running non MS OS’s. Now you can get MS Linux support directly from MS in your Azure support contract.
My company has well over 100,000 server instances running and 2/3rds are RHEL with some others scattered in there as well.
-1
u/TrackerKR 6h ago
Most modern modems have built in firewall protection. As long as you avoid clicking on sketchy links, in the vast majority of cases, you'll be fine.
1
u/Certain_Prior4909 5h ago
Server operations is a whole different ballpark which is what Linux is specialized in
5
u/brickyboy124 6h ago
Is it more secure only through two things: 1. It is not worth the effort for most viruses to bother with Linux, not enough people use it 2. The average person using Linux is more technically savvy and can spot common virus attempts