Hi there,
Win10 is soon not supported. Tbh Linux have been on my radar since I started to break from the US big tech.
But how is security handled in Linux? Linux is pretty open-source, or am I not understanding it correctly. So how can I as a new user make sure to have the most secure machine as possible?
Security is an insanely broad topic. As an average desktop user, keep your system up to date, and don’t run random programs from untrusted sources (most of the internet). This will cover almost everyones needs. For laptops, I’d recommend enabling drive encryption during installation, though note that data recovery is harder with it enabled.
That is good advice, however sadly a lot of install scripts are basically: download this script from us, and pipe it to a root shell.
Install scripts for what exactly?
Majority of software is packaged natively.
I hear don’t run random stuff from the internet alot but back when i was using windows, if i found something interesting on say github i would just download and run it and i expected windows defender to block any viruses. Is there something similar for linux? Like if I go around installing random Aur packages, is there anything stopping viruses from doing virus things?
Is there anything stopping viruses from doing virus things?
Usually that’s called sandboxing. AUR packages do not have any, if you install random AUR packages without reading them, you run the risk of installing malware. Using Flatpaks from Flathub while keeping their permissions in check with a tool like Flatseal can help guard against this.
The main difference is that even with the AUR being completely user submitted content, they’re centralized repositories, unlike random websites. Malware on the AUR is significantly less common, though not impossible. Using packages that have a better reputation will avoid some malware, simply because other people have looked at the same package.
There is no good FOSS Linux antivirus (that also targets Linux). Clamav “is the closest”, though it won’t help much.
i personally wouldn’t recommend encrypted drive for a beginner though
Why not? You (usually) just click the check box during install, and you have 1 extra password when you boot up your system. Doesn’t seem too hard but I might be missing something.
It’s surprisingly annoying trying to configure LUKS full disk encryption. I had to look up instructions many times over on Mint.
Wait what? I don’t use mint, but with every other distro you just check the box at install and that is it.
Are you saying its hard to configure after you have already installed? I could imagine it might be, but why not export a list of programs you use and back up the home directory. Reinstall and check the box, restore home, and import your package list?
Firstly, LUKS is under “physical disk for encryption” which is a stupid and confusing name.
Secondly, if you want to dual-boot with LUKS you need to manually configure the partitions.
Thirdly, you need to seperately assign root to be installed on the “physical disk for encryption”, and they have multiple volumes for that in the list.
Fourthly, as with all LUKS encrypted Linux distros you need a seperate EFI, boot, and root partition.
Fifthly, all of this partitioning is on a really small window that can’t be resized.
I don’t dual boot, so I guess there is that. But everything else seems very confusing. All other installers say, do you want this encrypted? You click yes. And that’s it.
TBH I’ve installed Mint, Kubuntu, and OpenSUSE and I don’t remember which ones had which issues. I think they’re all Mint but maybe not.
when you fuck shit up you can’t really easily boot in from a usb drive and learn the recovery process
It’s a few extra steps to start fixing, but it’s still definitely possible once you get the crypto device mapper.
Better to lose the data than have it stolen.
So long as you know that is the trade off, I would tend to agree with you, but knowing the standard desktop user, most will opt for the opposite of your statement.
They should not us LUkS and instead use veracrypt for folders and files. That way if any repartitioning or modification is needed it’s simple in gparted or GNOME disks on mint.
Source is been there and done that. Luks partitions are not easily resized.
So how can I as a new user make sure to have the most secure machine as possible?
That’s not what you want. You want a reasonable level of confidence that your system is secure.
The process is similar to Windows - keep it up-to-date, use good passwords, don’t run things as root (admin), and don’t install things that are questionable.
The package manager under linux is where you should start, and that varys by distro some. But generally speaking things installed from there are “safe” and will be updated by the package manager when you do updates.
There’s plethora of resources if you want to make your Linux install even more secure than the defaults (so-called “hardening”)
I just want to say that you’re probably worrying too much about it. Of course, there is lots of things one can do to improve security (which the others here are listing dutifully) and it is foolish to just assume that one’s computer is entirely secure, because as a user, you will always have the ability to bypass that.
But there’s a pretty firm consensus in the IT industry that Linux is more secure than Windows. And that the popular Linux distributions are more trustworthy organizations than Microsoft.
So, it’s good to inform yourself, but if you survived on Windows, you at least should not worry about the Linux side of things. It’s more than fine.
So how can I as a new user make sure to have the most secure machine as possible?
Shut the computer down. That’s it; computer as secure as possible.
Otherwise, if you actually want to use your computer, google for “threat model” first.
But generally: use an adblocker in your webbrowser, don’t execute random commands/tools from the internet before you know for sure what you’re doing, update stuff now and then and make backups.
What do you mean most secure? Because that is a very broad thing.
Since I was referring to win10 losing support I thought it was understood that I asked about security updates like windows does. Pardon me. But to specify, how is the ongoing security updates working on Linux? Who does it? Is it even being done? It is an assumption on my side that the security is done in the same manner like win and mac, with continuous updates but that might as well be a wrong assumption.
It depends on how you installed it.
If you installed something via apt on a Debian based system then Debian will track the projects and push updates when the are available. If you are doing things with Snap or Flatpack then the developers of those specific applications will have some form of update plan.
Ah okay… I am kinda new in the lingo so sorry if I butcher some of it.
So it is the developers of the distros who are pushing updates?
I know you can never trust companies like Microsoft, but they are a bit more regulated by laws as they are big corps… How can you trust a distro enough to e.g. use online banking ?
I think the ethos of open source flips this thinking. You should not trust. Microsoft may not be noting down your banking details, but you actually don’t and can’t know if it is. What it is doing is storing other personal data, because that is in its policies. Now, to what extent it takes advantage of this capability and permission, it is again unknown and unknowable.
Microsoft may be a big corp, but some distros are the backbone of highly critical systems, and collectively they run the vast majority of servers.
You don’t “trust” your distro. Or your laws. Everything being done is in the open, so you can see for yourself. If you lack the knowledge to do that, there are others who are doing it and many are sharing what they find. You will “trust” on some level, because of its reputation, how established it is, but trust here means something very different from letting a huge blob of unknown code do whatever it does because I trust you.
This is actually what I am a bit afraid of. Im danish and Denmark is becoming way to digital in the sense where we use digital ID to access banking and other systems which needs you to be identified (tax, healthcare etc).
The open source stuff is a bit daunting when you actually don’t know shit like me.
But as you say, Microsoft might not be better.
Honestly, Microsoft is one of the most active participants in the shitty fascist dystopian surveillance shitshow in the us right now. It’s not that it “might not be better”, they are literally one of the worst.
Open source doesn’t work on trust, it works on scrutiny. Which is much easier to do when everything is open and therefore auditable. The threat model is very different, and the mitigation process is much faster since thousands of companies, including the biggest ones, need a secure Linux to run all their servers.
Open source software security issues comme mainly from :
- plain old bugs like everything else
- supply chain attacks (Example), which are actually very difficult to pull off since they tend to actually fail because of said scrutiny
What open source software won’t do because doing so would immediately kill a project:
- deliberate backdoors “for law enforcement” like most commercial platforms
- invasive telemetry/spyware
- Microsoft Recall that literally records and stores indefinitely absolutely every single interaction you have with your computer
- basically everything that’s deliberately harmful to privacy and/or security
- enshittification to maximize profit since there is basically no financial incentive and no venture capitalist behind distros
Removed by mod
That’s an interesting question. It’s pretty nuanced. I don’t know of any laws that would stop Microsoft from going “oops, we had a bug in our software, sorry about that”. Same for the linux distros. Unless you’re a corporate customer, then that would be included as part of some contract. So at the end of the day you trust Microsoft’s reputation. You’d trust your distro of choice as well. So as a thought experiment I would suggest that the most secure operating system provider is the one that ships a very similar version of its OS to both end-users and enterprise customers. Some Linux distributions fall into that category, some definitely not.
Also, keep in mind that some distros are run mostly by individual contributors not employed by any knowingly reputable company, so I’d stay away from those by default.
what i did after install mint, enable firewall, disable vnc, ssh ,rdp ports. install opensnitch, install pihole
From a windows perspective Linux does 2 things differently which makes it more secure to Windows.
- Like MacOS it doesn’t need antivirus software like Norton. Windows needs antivirus because DOS the OS windows is based on, had it where any program had access to anything. This is still sadly true even on Windows 11. Linux is Sandboxed, where instead of giving the program full access to everything, you just give it a sandbox with what it needs.
Unless you deliberately run a program as the admin of Linux (su or sudo), malicious code can just delete system32.
- Linux’s is open source and while the desktop market share is tiny, there are a massive market in servers. As a result since there are a lot of eyes on the project if/when problems are found they are fixed quickly. I remember a time when a malicious actor was trying to add a backdoor into a library as a blob and it was caught.
Windows on the other hand is closed source, meaning if MS can’t find the issue, the only time it is found is when it’s in the field. To avoid downtime MS offers bug bounty programs for those who can find issues, rather than to let them exploit it.
I don’t know where you got your information from, but your mental model on how and why things work the way they do in both linux and windows seems to be really off.
Since you seem someone that is actually interested in understanding this stuff, I strongly suggest to find some better sources as your base
When I was taking cyber security, Sandboxing and Linux was one of the topics which was brought up.
Not sure when I associated it with the entire OS. It appears that the Host OS can be sandboxed for added security, and some containerized applications like Flatpaks are sandboxed. But not all applications are. Like the OS provided packages in most package managers.
Windows isn’t based on DOS, though. It hasn’t been for a very long time. Linux isn’t sandboxed. Userspace applications can be sandboxed. There’s a difference.
Yes modern Windows is based on the NT Kernal. However to keep with compatibility with older programs, NT needs to be compatible with DOS. For most people they never saw the transition from DOS to NT, since it was quietly done with Win XP.
NT even “back in the day” was very much NOT compatible with DOS.
Dude you really have no idea what you’re talking about.
One of the tips I’d give is the same for Windows, the best anti-virus is the user to know what he/she is doing. Linux is a better in that regard because it obfuscates very little, unlike Windows.
Also in line with viruses, given how many variants of a base system there can be, unless the virus is compiled in your machine, to my knowledge chances are higher for a virus to fail to function properly, or even at all. A way for a coder to circumvent it would be to bloat the code with system-specific instructions, which would be harder to create and optimize, but if a big enough group in resources take on the challenge, it could potentially be achieved.
On another point, something I expect to become a problem in Linux is that you need the admin’s password, which is pretty much the master key of the system, for way too many things, even to install a web browser or the equivalent of 7-Zip. With scams usually involving social engineering, having the user hand a key from a system that depends mainly on it makes the system far more vulnerable.
Now, given Windows is still the bigger desktop system, scammers and virus distribution still focus on it, but as Linux grows, more ill-intended people may focus on it.
But still, Windows has far less variants, barely anything there uses passwords or more adninistration-oriented safelocks, and is much worse for troubleshooting (and having used most systems from 98FE onward, I also think it’s getting worse), so I’d say Linux still has the advantages in those points I could think of.
Removed by mod
You’re going to need to be more specific. There are dozens of aspects of security.
But if you want to have the most secure machine, then never turn it on, encase it in lead, and drop it at the bottom of the ocean.
Since I was referring to win10 losing support I thought it was understood that I asked about security updates like windows does. But to specify, how is the ongoing security updates working on Linux? Who does it? Is it even being done? It is an assumption on my side that the security is done in the same manner like win and mac, with continuous updates but that might as well be a wrong assumption.
it’s similar. in a mainstream distribution with a desktop environment, updates can typically be configured to notify you or install automatically. it’s common for those updates to now also include third-party sources like flathub.
upgrades (to a next point release or major version) are different, some can be fairly straightforward–others, not so much. and those upgrades will be more frequent, as the “lifecycle” for most linux distributions is shorter than windows’ 10 years.
There are also rolling release distros that never need upgrades. You install the system once and normal updates are all it needs.
Security updates are provided by each package maintainer and released on their own schedule. Microsoft releases updates monthly on Patch Tuesday, unless there’s a severe vulnerability that can’t wait. But since Linux is a bunch of different packages rolled into a distro, there’s no one authority managing updates.
So, this means you might get them faster, or if a maintainer is not engaged, slower. Or, if a package is abandoned, not at all. Distros generally make sure their provided packages are maintained, but updates to third-party packages are not guaranteed.
Removed by mod
You don’t actually need “perfect” security in the future, any more than you did in the past. Windows was not perfect, right? So stop looking for perfection. Instead, look for “good enough for 99.9% of the world”. And you can get that with many of the popular Linux distributions.
Basically, install a popular distro, and keep your software to whatever is in the package manager. Don’t install random shit manually. Don’t download random software from random websites. Don’t fuck with security settings unless you read up on the topic very thoroughly. Then you’ll be fine.
Linux is always more secure than win10, so whatever your need, Linux is more secure. The biggest threat is almost always yourself, and what you open up, give away, and how easy you make the codes you use and so forth.
Security on Linux is lackluster.
Generally as long as you don’t install any untrustworthy programs you’ll be safe … but there’s a problem. Linux is an amalgamation of thousands of separate programs and most of them are maintained by one guy in Nebraska thanklessly. XZ Utils is a prime example of how vulnerable the Linux software stack is to malware.
My advice: Keep your daily driver separate from your gaming machine, use a debian-based distro like Ubuntu or Mint for your daily driver, and always have a disaster recovery plan. My advice would basically be the same for a Windows user.
EDIT: Also full-disk encryption. Both on Windows and Linux you can just read the contents of a hard drive no questions asked. Windows is going to address this with TPM’s but you can just use a password. Secure-boot is good because it can help guard against rootkits.
Most of the security is in the kernel so you can make sure you have the latest kernel. Also secureblue is a security focused distro that makes use of GrapeneOS’s hardened malloc so that’s the most secure one that I’m aware of.
