Linux security
from UheldigeBenny@feddit.dk to linux@lemmy.ml on 13 Sep 15:30
https://feddit.dk/post/15693927

Hi there,

Win10 is soon not supported. Tbh Linux have been on my radar since I started to break from the US big tech.

But how is security handled in Linux? Linux is pretty open-source, or am I not understanding it correctly. So how can I as a new user make sure to have the most secure machine as possible?

#linux

threaded - newest

frongt@lemmy.zip on 13 Sep 15:36 next collapse

You’re going to need to be more specific. There are dozens of aspects of security.

But if you want to have the most secure machine, then never turn it on, encase it in lead, and drop it at the bottom of the ocean.

UheldigeBenny@feddit.dk on 13 Sep 15:40 collapse

Since I was referring to win10 losing support I thought it was understood that I asked about security updates like windows does. But to specify, how is the ongoing security updates working on Linux? Who does it? Is it even being done? It is an assumption on my side that the security is done in the same manner like win and mac, with continuous updates but that might as well be a wrong assumption.

Aelyra@lemmy.ml on 13 Sep 16:00 next collapse

It’s kind of like Windows. You just hit that shiny “Update” button and boom, your software’s up to date and more secure. Depending on your Linux distro and setup, you might not even need to reboot, which is pretty cool.

Under the hood, most distros don’t really separate security updates from regular ones for everyday apps like your browser. They just roll them all together. But for the kernel, the super deep-core part of the system, sometimes you get security fixes without any new features. That helps keep things stable and safe.

relativestranger@feddit.nl on 13 Sep 16:19 next collapse

it’s similar. in a mainstream distribution with a desktop environment, updates can typically be configured to notify you or install automatically. it’s common for those updates to now also include third-party sources like flathub.

upgrades (to a next point release or major version) are different, some can be fairly straightforward–others, not so much. and those upgrades will be more frequent, as the “lifecycle” for most linux distributions is shorter than windows’ 10 years.

cmnybo@discuss.tchncs.de on 13 Sep 20:22 collapse

There are also rolling release distros that never need upgrades. You install the system once and normal updates are all it needs.

frongt@lemmy.zip on 13 Sep 17:30 collapse

Security updates are provided by each package maintainer and released on their own schedule. Microsoft releases updates monthly on Patch Tuesday, unless there’s a severe vulnerability that can’t wait. But since Linux is a bunch of different packages rolled into a distro, there’s no one authority managing updates.

So, this means you might get them faster, or if a maintainer is not engaged, slower. Or, if a package is abandoned, not at all. Distros generally make sure their provided packages are maintained, but updates to third-party packages are not guaranteed.

deadcade@lemmy.deadca.de on 13 Sep 15:37 next collapse

Security is an insanely broad topic. As an average desktop user, keep your system up to date, and don’t run random programs from untrusted sources (most of the internet). This will cover almost everyones needs. For laptops, I’d recommend enabling drive encryption during installation, though note that data recovery is harder with it enabled.

Tanoh@lemmy.world on 13 Sep 18:48 next collapse

That is good advice, however sadly a lot of install scripts are basically: download this script from us, and pipe it to a root shell.

msage@programming.dev on 14 Sep 11:37 collapse

Install scripts for what exactly?

Majority of software is packaged natively.

Jumuta@sh.itjust.works on 13 Sep 19:14 collapse

i personally wouldn’t recommend encrypted drive for a beginner though

procapra@lemmy.ml on 13 Sep 22:35 next collapse

Why not? You (usually) just click the check box during install, and you have 1 extra password when you boot up your system. Doesn’t seem too hard but I might be missing something.

Jumuta@sh.itjust.works on 14 Sep 01:18 next collapse

when you fuck shit up you can’t really easily boot in from a usb drive and learn the recovery process

[deleted] on 14 Sep 02:25 next collapse

.

Tenderizer78@lemmy.ml on 14 Sep 11:58 collapse

Better to lose the data than have it stolen.

Attacker94@lemmy.world on 15 Sep 19:07 collapse

So long as you know that is the trade off, I would tend to agree with you, but knowing the standard desktop user, most will opt for the opposite of your statement.

Tenderizer78@lemmy.ml on 14 Sep 11:58 collapse

It’s surprisingly annoying trying to configure LUKS full disk encryption. I had to look up instructions many times over on Mint.

NewNewAugustEast@lemmy.zip on 14 Sep 14:25 collapse

Wait what? I don’t use mint, but with every other distro you just check the box at install and that is it.

Are you saying its hard to configure after you have already installed? I could imagine it might be, but why not export a list of programs you use and back up the home directory. Reinstall and check the box, restore home, and import your package list?

Tenderizer78@lemmy.ml on 14 Sep 15:08 collapse

Firstly, LUKS is under “physical disk for encryption” which is a stupid and confusing name.

Secondly, if you want to dual-boot with LUKS you need to manually configure the partitions.

Thirdly, you need to seperately assign root to be installed on the “physical disk for encryption”, and they have multiple volumes for that in the list.

Fourthly, as with all LUKS encrypted Linux distros you need a seperate EFI, boot, and root partition.

Fifthly, all of this partitioning is on a really small window that can’t be resized.

NewNewAugustEast@lemmy.zip on 14 Sep 15:24 collapse

I don’t dual boot, so I guess there is that. But everything else seems very confusing. All other installers say, do you want this encrypted? You click yes. And that’s it.

Tenderizer78@lemmy.ml on 14 Sep 15:34 collapse

TBH I’ve installed Mint, Kubuntu, and OpenSUSE and I don’t remember which ones had which issues. I think they’re all Mint but maybe not.

OhVenus_Baby@lemmy.ml on 15 Sep 11:36 collapse

They should not us LUkS and instead use veracrypt for folders and files. That way if any repartitioning or modification is needed it’s simple in gparted or GNOME disks on mint.

Source is been there and done that. Luks partitions are not easily resized.

slazer2au@lemmy.world on 13 Sep 15:39 next collapse

What do you mean most secure? Because that is a very broad thing.

UheldigeBenny@feddit.dk on 13 Sep 15:41 collapse

Since I was referring to win10 losing support I thought it was understood that I asked about security updates like windows does. Pardon me. But to specify, how is the ongoing security updates working on Linux? Who does it? Is it even being done? It is an assumption on my side that the security is done in the same manner like win and mac, with continuous updates but that might as well be a wrong assumption.

slazer2au@lemmy.world on 13 Sep 15:49 collapse

It depends on how you installed it.

If you installed something via apt on a Debian based system then Debian will track the projects and push updates when the are available. If you are doing things with Snap or Flatpack then the developers of those specific applications will have some form of update plan.

UheldigeBenny@feddit.dk on 13 Sep 15:54 collapse

Ah okay… I am kinda new in the lingo so sorry if I butcher some of it.

So it is the developers of the distros who are pushing updates?

I know you can never trust companies like Microsoft, but they are a bit more regulated by laws as they are big corps… How can you trust a distro enough to e.g. use online banking ?

jutty@blendit.bsd.cafe on 13 Sep 16:09 next collapse

I think the ethos of open source flips this thinking. You should not trust. Microsoft may not be noting down your banking details, but you actually don’t and can’t know if it is. What it is doing is storing other personal data, because that is in its policies. Now, to what extent it takes advantage of this capability and permission, it is again unknown and unknowable.

Microsoft may be a big corp, but some distros are the backbone of highly critical systems, and collectively they run the vast majority of servers.

You don’t “trust” your distro. Or your laws. Everything being done is in the open, so you can see for yourself. If you lack the knowledge to do that, there are others who are doing it and many are sharing what they find. You will “trust” on some level, because of its reputation, how established it is, but trust here means something very different from letting a huge blob of unknown code do whatever it does because I trust you.

UheldigeBenny@feddit.dk on 13 Sep 16:13 collapse

This is actually what I am a bit afraid of. Im danish and Denmark is becoming way to digital in the sense where we use digital ID to access banking and other systems which needs you to be identified (tax, healthcare etc).

The open source stuff is a bit daunting when you actually don’t know shit like me.

But as you say, Microsoft might not be better.

Aelyra@lemmy.ml on 13 Sep 16:20 next collapse

If you’re trying to avoid forced telemetry and similar tracking, you’re generally safer with most of the big Linux distros. Most of them don’t collect data at all, and if they do, it’s usually easy to opt out with just a click.

Going for lesser-known distros does increase your risk a bit, but the fact that they’re open source helps deter some bad actors, since the code can be inspected by others.

And if you’re worried about super-sophisticated backdoors, keep in mind you’re not exactly safe with Microsoft either. A rogue employee could still cause harm, and because it’s closed source, any malicious changes might take way longer to catch.

Wfh@lemmy.zip on 13 Sep 17:04 collapse

Honestly, Microsoft is one of the most active participants in the shitty fascist dystopian surveillance shitshow in the us right now. It’s not that it “might not be better”, they are literally one of the worst.

Open source doesn’t work on trust, it works on scrutiny. Which is much easier to do when everything is open and therefore auditable. The threat model is very different, and the mitigation process is much faster since thousands of companies, including the biggest ones, need a secure Linux to run all their servers.

Open source software security issues comme mainly from :

  • plain old bugs like everything else
  • supply chain attacks (Example), which are actually very difficult to pull off since they tend to actually fail because of said scrutiny

What open source software won’t do because doing so would immediately kill a project:

  • deliberate backdoors “for law enforcement” like most commercial platforms
  • invasive telemetry/spyware
  • Microsoft Recall that literally records and stores indefinitely absolutely every single interaction you have with your computer
  • basically everything that’s deliberately harmful to privacy and/or security
  • enshittification to maximize profit since there is basically no financial incentive and no venture capitalist behind distros
rollmagma@lemmy.world on 13 Sep 16:25 collapse

That’s an interesting question. It’s pretty nuanced. I don’t know of any laws that would stop Microsoft from going “oops, we had a bug in our software, sorry about that”. Same for the linux distros. Unless you’re a corporate customer, then that would be included as part of some contract. So at the end of the day you trust Microsoft’s reputation. You’d trust your distro of choice as well. So as a thought experiment I would suggest that the most secure operating system provider is the one that ships a very similar version of its OS to both end-users and enterprise customers. Some Linux distributions fall into that category, some definitely not.

Also, keep in mind that some distros are run mostly by individual contributors not employed by any knowingly reputable company, so I’d stay away from those by default.

johannes@lemmy.jhjacobs.nl on 13 Sep 15:51 next collapse

As others have said, Linux Security is a very broad topic. But the main thing is keeping your system updated, only install packages from your distro’s repositories, install a firewall and don’t install anything you don’t need should go a long way :)

For example, i use Alpine Linux as a desktop OS. This means i only install packages through apk, from the Alpine repositories. I run apk update and apk upgrade commands every friday. I use Flathub for most desktop software which i also update weekly. (To be even more secure, only install verified flatpak’s). my firewall has no incoming ports open (really not needed on my desktop). And i keep myself updated with the latest news regarding Alpine Linux, and Linux in general. So i am aware of most vulnerabilities as they are published. This is a pretty secure system.

Later on if you want even more security you can start following the CIS guidelines for your favorite distro, but the above should be a good start.

But good security is not just jeeping your system updated, it also means you have good backups in place, in case randsomware hits your system. And then there’s also the monitoring of your system for suspicious behaviour :) But these are far more advanced topics!

Auster@thebrainbin.org on 13 Sep 16:01 next collapse

One of the tips I'd give is the same for Windows, the best anti-virus is the user to know what he/she is doing. Linux is a better in that regard because it obfuscates very little, unlike Windows.

Also in line with viruses, given how many variants of a base system there can be, unless the virus is compiled in your machine, to my knowledge chances are higher for a virus to fail to function properly, or even at all. A way for a coder to circumvent it would be to bloat the code with system-specific instructions, which would be harder to create and optimize, but if a big enough group in resources take on the challenge, it could potentially be achieved.

On another point, something I expect to become a problem in Linux is that you need the admin's password, which is pretty much the master key of the system, for way too many things, even to install a web browser or the equivalent of 7-Zip. With scams usually involving social engineering, having the user hand a key from a system that depends mainly on it makes the system far more vulnerable.

Now, given Windows is still the bigger desktop system, scammers and virus distribution still focus on it, but as Linux grows, more ill-intended people may focus on it.

But still, Windows has far less variants, barely anything there uses passwords or more adninistration-oriented safelocks, and is much worse for troubleshooting (and having used most systems from 98FE onward, I also think it's getting worse), so I'd say Linux still has the advantages in those points I could think of.

Aelyra@lemmy.ml on 13 Sep 16:08 collapse

Also in line with viruses, given how many variants of a base system there can be, unless the virus is compiled in your machine, to my knowledge chances are higher for a virus to fail to function properly, or even at all.

Cross-platform malware does exist, and one of the most common and practical forms is malicious browser extensions. A harmful Chrome or Firefox add-on can function just as effectively on Linux as it does on Windows.

On another point, something I expect to become a problem in Linux is that you need the admin’s password, which is pretty much the master key of the system, for way too many things, even to install a web browser or the equivalent of 7-Zip. With scams usually involving social engineering, having the user hand a key from a system that depends mainly on it makes the system far more vulnerable.

Multiple types of dangerous malware can run on Linux without requiring root privileges. As previously mentioned, malicious browser extensions pose a significant threat. Harmful actions like deleting files or logging keystrokes can also be carried out using a Python script that doesn’t need root access.

Linux is undoubtedly more secure than Windows for a variety of reasons, but Linux users should still remain cautious. No system is completely invulnerable.

sunoc@sh.itjust.works on 13 Sep 16:02 next collapse

Great to hear you’re willing to move to Linux!

Like other comments pointed, there is no such thing as “most secure”. It’s a deep rabbit hole and it’s better in general to assume that any device connected to the internet is at risk. Hell, any storage can be compromised if the entity interested put enough effort into it.

I recommande reading the page on Privacy Guides, it gives a good overview. In general, you should consider your thread model: what is you situation and why do you want security or privacy for?

  • Regarding security, I would say for a general case, any modern, popular Linux distro with full disk encryption is probably good enough and as secure as any other OS. I would recommande going with a Fedora Silverblue or an OpenSUSE Tumbleweed, but the more popular Ubuntu or Mint are great as well for new users.
  • If you also want “good enough” privacy, you should focus more on the software you are running, and the situation of your data, especially in your usage of your web browser. But that’s a different topic entirely.
  • If you actually want more advanced security though, that’s where it becomes difficult/fun. You need to consider what you are trying to protect yourself from, specifically. Virus? Maybe a compartmentized OS like Qubes might be a solution. Physical access to your device? You can get a dead man switch that kills you system disk if your laptop is taken away from you. You want to hide your OS install from a security inspection? You can set a deniable full disk encryption with a facade OS that protect your from a rubber hose attack. Probably many other things exist I am not aware of.

But anyway, if your question is “Is a Linux distro at least as secure as my previous Windows”, the answer is definitely YES imo. And if you want MOAR, it’s gonna be a fun ride!

[edit: and yes, updates! Update you system plz.]

Ephera@lemmy.ml on 13 Sep 16:34 next collapse

I just want to say that you’re probably worrying too much about it. Of course, there is lots of things one can do to improve security (which the others here are listing dutifully) and it is foolish to just assume that one’s computer is entirely secure, because as a user, you will always have the ability to bypass that.

But there’s a pretty firm consensus in the IT industry that Linux is more secure than Windows. And that the popular Linux distributions are more trustworthy organizations than Microsoft.

So, it’s good to inform yourself, but if you survived on Windows, you at least should not worry about the Linux side of things. It’s more than fine.

infjarchninja@lemmy.ml on 13 Sep 17:53 next collapse

When my kids were in their teens they had windows machines.

They had windows machines, because all their friends had windows machines.

you know what kids are like, click on every thing. oblivious to danger.

malware, viruses, the lot. of course, good old idiot dad had to sort it out. spending hours running anti-virus programs and malwarebytes etc

I got really annoyed one day and while they were at school. I totally removed windows and installed linux mint xfce on both their machines.

Set everything up for them exactly how I used my linux machine.

Once they were online, had their web browser open, found they could login in to all the things they liked and still enage with their friends.

I never heard a peep from them. no more anti-virus scans or malware.

It was heaven.

Ive used Linux for 20 years and never had a virus.

spaghettiwestern@sh.itjust.works on 13 Sep 18:13 next collapse

I’ve used Linux Mint and other distros daily for more than 10 years. Never had a virus or malware issue and don’t even run antivirus software.

During that same time I’ve had to help friends remove viruses and malware from their Windows machines dozens of times. The latest Windows disaster I’ve assisted with was a few months ago. A retired friend had her Windows 10 machine hijacked and $8K stolen from her savings account. Making sure the malware was removed required hours of work formatting the drive and reinstalling Windows.

IMO you are far safer with a plain vanilla Linux install that you are with Windows, no matter what steps you take to secure your Windows installation.

Mihies@programming.dev on 13 Sep 20:19 collapse

You sure though? Windows has more viruses because it’s more popular (desktop) and monolithic, not because Linux is much better in that regard. IOW Linux is not magically virus resistant. If you run an infected file, it will infect both without much trouble. Also removing infection would be similar. At least that’s my understanding.

DiamondOrthodox@lemmy.ml on 13 Sep 20:52 next collapse

It’s hard enough getting legit software in general to work on Linux. Even if a virus was written for Ubuntu, it is likely not going to run on Fedora, or Arch, or even downstream/upstream versions of Ubuntu.

Edit: Although thinking about it, Linux terminal commands are pretty universal, so if you manage to execute a script or terminal command as root or sudo then I guess it could apply to multiple distros.

Mihies@programming.dev on 14 Sep 06:32 collapse

Ha, yes, incompatibility is the secret defense of linux 🫣. But even without root access, malware can create a lot of damage.

spaghettiwestern@sh.itjust.works on 13 Sep 21:26 next collapse

You sure though?

What do you want? It should go without saying that I am absolutely sure of my own experience.

In probably 15 years total of running Linux I have not had a single problem with malware or viruses. Part of that time was also running Windows regularly and my Windows systems DID become infected with both malware and viruses occasionally, despite my best efforts. And you’re not mentioning the fact that Linux runs on 63% of the server market and those systems are under constant attack.

Reports of Linux system infections are truly rare, and considering the nature of the user community would be widely and loudly reported if they were happening.

Do you have any experience in this matter? Have you had your own Linux installations infected, or are you a Windows user questioning what you’re reading? (Perfectly reasonable if the 2nd one’s the case.) Please fill us in on the details.

Mihies@programming.dev on 14 Sep 06:37 collapse

Servers are a different story. I’m both Windows and Linux user, meaning more towards the later recently. I’m still wondering why do you think Linux is more resistant to malware - besides the incompatibility (mentioned in other reply here). Your experience doesn’t tell much about why and I wrote my theory.

spaghettiwestern@sh.itjust.works on 14 Sep 07:39 collapse

Do you have any experience with Linux viruses? Have you had your own Linux installations infected with viruses or malware?

Mihies@programming.dev on 14 Sep 07:59 collapse

I think I’m cautious enough to not have the experience, luckily. But why does that matter? I’m still waiting from you for rationale why is Linux experiencing less infections. And you keep asking unimportant questions…

spaghettiwestern@sh.itjust.works on 14 Sep 08:56 collapse

Glad you haven’t had any issues. Have a good night.

Tenderizer78@lemmy.ml on 14 Sep 11:56 collapse

The Linux kernel is monolithic too. This and the slow adoption of Rust are the two major security complaints of the GrapheneOS regarding Linux. I might change to COSMIC when it’s ready just to spite the luddites that oppose Rust.

Mihies@programming.dev on 14 Sep 15:25 collapse

My bad, used the wrong word there. I meant that Windows is very compatible with older versions and different flavors.

Tenderizer78@lemmy.ml on 14 Sep 15:39 collapse

“Unified” is the word I’d use then. Linux being the opposite, “fragmented”.

muusemuuse@sh.itjust.works on 13 Sep 18:38 next collapse

Windows has a lot of shit to second guess the user. Linux doesn’t. Linux doesn’t babysit you. It has some guardrails but the general idea with Linux is it’s your computer, it will do what you tell it do, even if it’s a bad idea. This makes things lighter, faster, more private, but it has also led to security incidents.

Windows and Mac will watch what you are doing. If they see something suspicious, the security software can jump in and telemetry means they can notice patterns as new malware appears on their users machines. This makes the machines slower and heavier and less private, but also easier for users to deal with because they doesn’t have to actually know anything. They can just buy their way out of a problem with superdupertotallaylegitantivirus2025pro.

Anyone who says Linux doesn’t get viruses is lying to you. It does. They all do. But it’s not that common because Linux is a smaller market share so most nefarious people won’t waste their time on a smaller target unless there is something that specific target has they want. So old people using fedora kinoite to access email and facebook are fine, but Pete Hegseth watching ignoring security practices and visiting shady sites is probably a worthwhile target and could be vulnerable.

Linux has major advantageous over the industry approach of “we know best” but it also has disadvantageous. If you are the kind of person who wants to learn and improve and grow, Linux could work for you. If you are more the irresponsible buy-someone-else’s-solution-to-my-problems type, it’s not.

Ulrich@feddit.org on 13 Sep 19:22 next collapse

Most of the security is in the kernel so you can make sure you have the latest kernel. Also secureblue is a security focused distro that makes use of GrapeneOS’s hardened malloc so that’s the most secure one that I’m aware of.

BCsven@lemmy.ca on 13 Sep 19:23 next collapse

Microsoft being closed source hides their bugs and vulnerabilities. Even when security researchers have sent in reports MS has sat on them due to profit being motive not security, and not taking vulners seriously until the researchers say screw that and publish it.

Linux being open can have all eyes on it, and if there is an exploit, there is a community willing to help ASAP.

On many distros you may have weekly or even daily updates or patches coming through with fixes. A distro like OpenSUSE has various patch and list patch commands that show what security patches are avilailable, their status (critical, recommended) and if it’s needed on your system or not depending on what you have installed. You don’t get transparency on closed source systems.

If you are paranoid about security you can use AppArmor tools or SELinux. AppArmor can be set to learn how an app behaves, then you lock it so the app can’t do new things.

SELinux you set rules for files and folders, so even with remote access an attacker can’t access data if rules don’t allow file listing over SSH etc

KernelTale@programming.dev on 16 Sep 10:58 collapse

Can I use it to run pirated games through WINE and Lutris?

BCsven@lemmy.ca on 16 Sep 15:50 collapse

I’m sure you could. I personally haven’t tried that, but games work well for me, as do the random windows engineering tools I gathered in the 2000s

arsCynic@beehaw.org on 13 Sep 21:00 next collapse

So how can I as a new user make sure to have the most secure machine as possible?

  1. Always use uBlock Origin in a Firefox-based browser (e.g., LibreWolf, Zen).
  2. Never click on links in communication of any kind that you didn’t expect or are too good to be true.
  3. Never reinstall Windows.

⚜︎ arscyni.cc: modernity ∝ nature.

pineapplelover@lemmy.dbzer0.com on 13 Sep 21:00 next collapse

There’s a lot of people with the idea that open source can’t be secure because people see the source code.

But imagine this. You have 2 locks, one that is completely viewable of the innerworkings, and another that is covered, both have been unbreakable, but could you imagine the balls on the guy that made the clear lock? Imagine feeling so confident that your lock was clearly the best, that you just expose it to any hacker ever and they still can’t get in.

Microsoft can barely get things working with their closed source code.

In reality, anything is exploitable and hackable eventually. With the open source community there are so many eyes on it that when someone notices that the program is running 2 seconds slower than it used to, they discover a vulnerability instead of just accepting it and saying “probably MS doing some BS” and dealing with it.

CheesyFox@lemmy.sdf.org on 14 Sep 07:18 collapse

your analogy doesn’t quite work here tbh.

It’s not a transparent lock, a transparent lock would be easy to pick. It’s more of a usual lock, but everyone can see all the blueprints and changes done to them. You can make changes to the blueprints yourself, and if the locksmiths approve of it, the next iteration of the lock will have them included.

Everyone who’s in the set of users of OSS software can contribute, therefore the set of people in control of the software that want it to have no backdoors whatsoever is always larger than the set of people who want to let the backdoors in, unlike in closed source, where corporate can singlehandedly decide to include a backdoor on purpose, not to mention, lots of OSS projects have such a large quantities of different people working on them, corpos won’t be able to gather so much humanpower under a single project ever.

communism@lemmy.ml on 13 Sep 21:00 next collapse

To be honest, security in the desktop Linux space has traditionally been a bit shit.

Since you’re new, it’s important for you to understand that Linux is a kernel. That’s the most low-down part of your operating system that handles your OS talking to your hardware and vice versa. Linux is not a full OS; it doesn’t provide any userspace tools that an OS provides. That’s why people don’t install Linux on its own, but they install Linux distributions, which are full OSes using the Linux kernel that come with more or less software to make Linux a complete OS, or at least bootable. That means that there is no one way to do things in Linux. There are some Linux distributions that are security-focused, such as Qubes OS and Alpine Linux. There’s also the new immutable distros, which provide security because the entire OS is defined declaratively, meaning you can easily rollback changes, and it’s harder to get infected with malware on those systems. There’s a lot of variability. Some systems are quite secure by default. A lot of other systems do not set up any security measures by default and expect the user to do that.

If you’re interested in hardening your Linux install, I would recommend the Arch wiki’s security page which has a lot of good advice.

Security is a really broad topic and the relevant security measures for you are going to vary based on your threat model. General good practices include using some form of MAC, setting up a firewall, don’t install random crap you don’t need (and if you are getting software from somewhere that isn’t vetted, e.g. the AUR, you should vet it yourself—e.g. if you use the AUR, learn to read PKGBUILDs), use full-disk encryption. Anti-virus software is largely not necessary on Linux, especially if you only install software from your package manager and follow other security good practice.

transscribe7891@lemmy.dbzer0.com on 13 Sep 21:37 next collapse

I used to use ClamAV, but not sure I noticed much of a difference, so haven’t really used any antivirus software for a while now. Curious what people in this thread think of clam.

Nilz@sopuli.xyz on 13 Sep 22:44 collapse

ClamAV looks for signatures of known viruses, most of which target Windows and not Linux. So it’s debatable how much more secure you really are by running ClamAV

missfrizzle@discuss.tchncs.de on 14 Sep 01:31 next collapse

the most secure possible? you’ll need to learn a ton. you’ll get there, but it’ll take a while.

decently secure? install Linux Mint, install your updates, don’t run sketchy commands with URLs in them unless you know what you’re doing, maybe follow a hardening guide. you’ll be okay.

if you need to be extremely secure and private, install Tails on a USB stick. it will be slow and frustrating, and you’ll need to save files to a second USB drive, but it will probably keep you pretty safe, and it’s decently user-friendly. just make sure you keep Tails updated! you’ll have to do that by flashing the new Tails onto a new USB drive, there’s no easy way around that.

those are your two most user-friendly, safe approaches.

Ashiette@lemmy.world on 14 Sep 06:49 next collapse

To have the most secure machine possible, you might need a hardened kernel but you absolutely need to have SELinux (or equivalent) rules set up.

The easiest way to have a go at this would be to install OpenSuSE (any version will do, they all ship with SELinux ootb) and follow guides on how to setup SELinux permissions.

unique_hemp@discuss.tchncs.de on 14 Sep 12:30 collapse

Or Fedora

bykdd@lemmy.dbzer0.com on 14 Sep 07:03 next collapse

what i did after install mint, enable firewall, disable vnc, ssh ,rdp ports. install opensnitch, install pihole

rezad@lemmy.world on 14 Sep 08:36 next collapse

if you mean the most secure desktop? then linux is not. not by a long shot.

use windows.

…github.io/security-privacy-advice.html#desktop-o…

madaidans-insecurities.github.io/linux.html

if you mean most most free, linux it is. personally I use linux.

pitiable_sandwich540@feddit.org on 14 Sep 09:58 next collapse

I think this article is a great analysis of what deep rooted flaws linux desktop distros have, but I think it is a bit disconnected from the average user (obligatory xkcd).

If the average linux user needs a programm they google what they need land on stack overflow telling them to use their package manager to install it.

If the average windows user needs a program/feature, they google it. They klick on the first link and install the first .exe they find. Has anyone you know used the microsoft store?

Or take gaming as another example. The default expirience for online multiplayer games requires kernel level anticheat on windows. This effectively circumvents windows carefully crafted security model for most tripple A online games.

So yes the average linux machine is probably not as secure as a MacOs or windows machine. But the way they are commonly used I highly doubt windows machines are more secure.

MonkderVierte@lemmy.zip on 14 Sep 10:26 collapse

About sandboxing, not like the Java-VM helps much in Android security.

The inherent problem why sandboxing should not be on this list:

<img alt="sandboxing cycle" src="https://lemmy.zip/api/v3/image_proxy?url=https%3A%2F%2Fimgs.xkcd.com%2Fcomics%2Fsandboxing_cycle_2x.png">

shreyan@lemmy.cif.su on 14 Sep 10:00 next collapse

Security is a rabbit hole.

You’re going to end up wasting a lot of time and effort on learning about something that in the end will not have a substantial impact on your computing experience.

It will make you look good in front of losers on the internet you’ll never meet, though.

Cyber@feddit.uk on 14 Sep 10:09 next collapse

Just make sure everything’s updated.

Microsoft do a good job of updating drivers and their applications, but Windows application updates vary so much.

For Linux - mostly - the distro maintainers handle all updates and just updating is usually enough.

After that it’s down to you… if you disable all the built-in protection and visit dodgy websites then any OS is going to struggle.

You can improve the out-of-box security by removing software you don’t use, improving default configurations (one size doesn’t fit all) and considering if you want additional security software - this applies to any OS.

So, to return to your question, choose a Linux distro which has regular updates and only contains applications that you use.

fodor@lemmy.zip on 14 Sep 10:25 collapse

Visiting dodgy websites in itself isn’t as risky as you make it out to be. There are very few exploits in an updated version of Chrome or Firefox that would compromise your machine.

Cyber@feddit.uk on 15 Sep 06:14 collapse

I think you’re agreeing with me then.

My first point is keeping everything updated - which would include the browser(s)

My later point was visiting dodgy sites with protections disabled.

MonkderVierte@lemmy.zip on 14 Sep 10:17 next collapse

So how can I as a new user make sure to have the most secure machine as possible?

Shut the computer down. That’s it; computer as secure as possible.

Otherwise, if you actually want to use your computer, google for “threat model” first.

But generally: use an adblocker in your webbrowser, don’t execute random commands/tools from the internet before you know for sure what you’re doing, update stuff now and then and make backups.

fodor@lemmy.zip on 14 Sep 10:30 next collapse

You don’t actually need “perfect” security in the future, any more than you did in the past. Windows was not perfect, right? So stop looking for perfection. Instead, look for “good enough for 99.9% of the world”. And you can get that with many of the popular Linux distributions.

Basically, install a popular distro, and keep your software to whatever is in the package manager. Don’t install random shit manually. Don’t download random software from random websites. Don’t fuck with security settings unless you read up on the topic very thoroughly. Then you’ll be fine.

ColdWater@lemmy.ca on 14 Sep 10:50 next collapse

Nothin, just install your favourite distro and don’t run random command/scripts/binaries you found on the internet

atzanteol@sh.itjust.works on 14 Sep 13:33 collapse

Like those ‘curl | sudo bash’ abominations that have become strangely popular lately.

Tenderizer78@lemmy.ml on 14 Sep 11:48 next collapse

Security on Linux is lackluster.

Generally as long as you don’t install any untrustworthy programs you’ll be safe … but there’s a problem. Linux is an amalgamation of thousands of separate programs and most of them are maintained by one guy in Nebraska thanklessly. XZ Utils is a prime example of how vulnerable the Linux software stack is to malware.

My advice: Keep your daily driver separate from your gaming machine, use a debian-based distro like Ubuntu or Mint for your daily driver, and always have a disaster recovery plan. My advice would basically be the same for a Windows user.

EDIT: Also full-disk encryption. Both on Windows and Linux you can just read the contents of a hard drive no questions asked. Windows is going to address this with TPM’s but you can just use a password. Secure-boot is good because it can help guard against rootkits.

ILikeBoobies@lemmy.ca on 14 Sep 12:02 next collapse

Keep your user account in user space.

Avoid unnecessary root access.

the16bitgamer@programming.dev on 14 Sep 12:06 next collapse

From a windows perspective Linux does 2 things differently which makes it more secure to Windows.

  1. Like MacOS it doesn’t need antivirus software like Norton. Windows needs antivirus because DOS the OS windows is based on, had it where any program had access to anything. This is still sadly true even on Windows 11. Linux is Sandboxed, where instead of giving the program full access to everything, you just give it a sandbox with what it needs.

Unless you deliberately run a program as the admin of Linux (su or sudo), malicious code can just delete system32.

  1. Linux’s is open source and while the desktop market share is tiny, there are a massive market in servers. As a result since there are a lot of eyes on the project if/when problems are found they are fixed quickly. I remember a time when a malicious actor was trying to add a backdoor into a library as a blob and it was caught.

Windows on the other hand is closed source, meaning if MS can’t find the issue, the only time it is found is when it’s in the field. To avoid downtime MS offers bug bounty programs for those who can find issues, rather than to let them exploit it.

ramenu@lemmy.ml on 14 Sep 12:13 next collapse

Windows isn’t based on DOS, though. It hasn’t been for a very long time. Linux isn’t sandboxed. Userspace applications can be sandboxed. There’s a difference.

the16bitgamer@programming.dev on 14 Sep 12:41 collapse

Yes modern Windows is based on the NT Kernal. However to keep with compatibility with older programs, NT needs to be compatible with DOS. For most people they never saw the transition from DOS to NT, since it was quietly done with Win XP.

atzanteol@sh.itjust.works on 14 Sep 13:36 next collapse

NT even “back in the day” was very much NOT compatible with DOS.

Krudler@lemmy.world on 14 Sep 13:52 collapse

Dude you really have no idea what you’re talking about.

Eggymatrix@sh.itjust.works on 14 Sep 12:25 collapse

I don’t know where you got your information from, but your mental model on how and why things work the way they do in both linux and windows seems to be really off.

Since you seem someone that is actually interested in understanding this stuff, I strongly suggest to find some better sources as your base

the16bitgamer@programming.dev on 14 Sep 12:39 collapse

When I was taking cyber security, Sandboxing and Linux was one of the topics which was brought up.

docs.redhat.com/…/chap-security-enhanced_linux-se…

Not sure when I associated it with the entire OS. It appears that the Host OS can be sandboxed for added security, and some containerized applications like Flatpaks are sandboxed. But not all applications are. Like the OS provided packages in most package managers.

reluctant_squidd@lemmy.ca on 14 Sep 12:49 next collapse

I would argue that Linux is inherently much more secure than windoze, simply because of how it handles user space vs. System (root access vs. User access). Also by how transparent its configuration is and how much information is readily accessible detailing how it works and how to adjust things.

However, when talking security for anything above the average user’s browsing needs, it can get very complicated depending on what you are trying to achieve.

Think of it like building something to keep out honest people vs. to keep out hardened, knowledgeable, clever thieves. Obviously the latter is going to take more time and resources to achieve, while the need to keep out more sophisticated bad actors would probably only be needed if you have something they might want.

Here are some suggestions for searching if actual security is your goal. Others can chime in with more things if they want. This is just some topics/programs you can read about to dip your toes in.

  • nftables/Firewalld (common firewalls)
  • wireguard/openvpn (vpn protocols)
  • rootless containers (podman)

Best of luck!

Cysioland@lemmygrad.ml on 14 Sep 13:28 next collapse

There’s plethora of resources if you want to make your Linux install even more secure than the defaults (so-called “hardening”)

utopiah@lemmy.ml on 14 Sep 13:32 next collapse

Others have said it before but basically : what is YOUR (not me, not your best friend, nor your colleague, etc) threat model?

To clarify that means WHO is actually trying to threaten your security?

Typical for most people it would be :

  • scammers trying to get pieces of your identity or your local cryptocurrency wallet or resources they can use to repeat that on to others.

For some people, like activists or political journalists it would be :

  • national actors, e.g. governments, with their surveillance apparatus, who might end up on a list with a set of conditions that would trigger some automated scan to get e.g. Signal logs

For very very few people, say Edward Snowden, who within the previous group actually did trigger some action :

  • actual team of hackers trying to hack into their devices

So as you can imagine if you are part of group 1, 2 or 3 then way you will protect yourself is totally different. What you will also have to protect is also different, e.g. if you have no cryptowallet but are traveling you might have to protect your phone physical phone and its data.

So… if you are serious about this, take a cybersecurity class. There are plenty available but how a computer works, software and hardware alike, is precisely what makes them simultaneously powerful and also dangerous. There are plenty of ways to break security (e.g. return oriented programing), plenty of ways that practically impossible (e.g. encryption) due to the very nature of computers (i.e. computational complexity) which IMHO makes this one of the most fascinating topic. Ask yourself come the credit card in your pocket (costing few bucks to make) can’t be cracked by the largest super computers (costing billions) on Earth?

TL;DR: no offense but you don’t seem to be ready for the answer without getting the basics first.

atzanteol@sh.itjust.works on 14 Sep 15:18 next collapse

So how can I as a new user make sure to have the most secure machine as possible?

That’s not what you want. You want a reasonable level of confidence that your system is secure.

The process is similar to Windows - keep it up-to-date, use good passwords, don’t run things as root (admin), and don’t install things that are questionable.

The package manager under linux is where you should start, and that varys by distro some. But generally speaking things installed from there are “safe” and will be updated by the package manager when you do updates.

Core_of_Arden@lemmy.ml on 14 Sep 15:21 next collapse

Linux is always more secure than win10, so whatever your need, Linux is more secure. The biggest threat is almost always yourself, and what you open up, give away, and how easy you make the codes you use and so forth.

synapse1278@lemmy.world on 14 Sep 18:44 collapse

  • Set a decently good password (password is required frequently on Linux, so do go overboard with a 40-random-characters-long password, you will regret it)
  • don’t install programs or run scripts from shady sources, prefer to install programs from the Software store (package manager and flatpak)
  • setup a backup system to regularly copy all your files to a separate storage device. This is the way to protect yourself from ransomware but also user errors! Having the possibility to format your drive, reinstall and restore backup in a 1 hour time span is going to give you the peace of mine you need for exploring and experimenting with Linux
Garbagio@lemmy.zip on 15 Sep 20:22 collapse

Currently my favorite passwords are song lyrics from my favorite songs. You can easily hit 60 characters, and they’re easy to remember!