Comment by cogman10 | Hacker News Reader

Comment by cogman10 | Hacker News Reader

Parent Full thread

It seems like your thesis is disproved in your own examples.

Linux is hugely popular on phones (android), which are every bit as juicy (if not more so at this point) than a desktop target.

There is mobile malware but it's far more rare and harder to come by.

But then there's just the fact that the way software is installed on a linux machine is wildly different from how you'd install it on windows. Just getting that binary blob to run requires some heroic efforts (To the point where we've pretty much decided it's easier to distribute via containers rather than compiled binaries for a given desktop).

And if we expand beyond the desktop, we find linux everywhere in the server world. Easily the most popular OS to run server software. Which makes it a hugely valuable target for hackers. They'd love nothing more than to compromise a bank server.

To say there's nothing about linux that makes it inherently more secure than windows seems just unreal. Because nix was designed around multiple users from the ground up, user permissions have been baked into the common flow for decades. That alone creates a huge layer of security that makes things like root kits or worms running at root super hard to pull off. The old windows (9->XP) pretty much gave everyone running admin permissions. Writing or changing a system32 dll was child's play.

To exploit linux, you have to either trick a user to run something with elevated permissions or find a vulnerability in software running with root permissions. To exploit windows (particularly older windows) you have to trick a user to run your software.

Android malware isn't rare or harder to come by at all. Every so often even Google has to remove a whole lot of apps from the store due to malware and these are apps that went live and were downloaded. Some of this being even more intense malware than on desktop, as people rarely store contacts or SMS on a desktop (Joker malware for example). You've negated your entire point.

The vast majority of "malware" on phones isn't software that exploits security bugs in the system software. Instead it's software that effectively asks the user nicely to give up their information, using mechanisms provided by the system software to do just that. This isn't something you can trivially prevent, as some software really does need access to your location, contacts, SMS, etc.

The response to true malware on Android isn't looking for and removing APKs from compromised devices after the fact, it's patching the vulnerabilities in system APIs.

same is true for windows... zero day exploits are hard and get patched rather quickly in all major operating systems

It is always the abuse of legitimate features which are the problem

More intense than the desktop? I think not.

At the windows malware peak, your system could be infected merely by having an internet connection. How many android worms are there? None that I can think of.

Heck, windows PCs were regularly infected by browsing the wrong website. Or getting served a malicious advertisement. Can you honestly say that people are getting infected on Android regularly by surfing the internet?

The vast majority of android malware relies on social engineering to get the end user to grant a malicious app permissions to be malicious. That's hardly a failing of the OS. It's also nowhere near as bad as "I'm online and now risk being infected".

> Heck, windows PCs were regularly infected by browsing the wrong website. Or getting served a malicious advertisement. Can you honestly say that people are getting infected on Android regularly by surfing the internet?

I have used Windows for nearly 2 decades and I can't tell you the last time my system was infected. I do agree that browsers are the largest vector of attack but that also means browser vendors share some of the largest responsibility for creating secure systems.

Two decades ago was near the end of that Windows-malware peak. And really, if you were behind a NAT two decades ago, that would have stopped nearly all of it, so you might not have noticed how bad it was unless you were supporting a lot of Windows machines in varied environments.

There was a span of a few years when a Windows box connected directly to the Internet, using a public address, would reliably get pwned before long, even with nobody using it. But that was quite a while ago, and, again, just being behind a NATing router mostly solved the problem (assuming nothing infected ever connected to your local network).

Why would you need root on a typical linux system? A program running under your user account can alter config (in your home directory) to make sure it always runs when you log in, can add programs to your path by altering your path, can access all your personal files and can debug-attach to all processes and do what it likes with them (and your personal data) in order to spread mayhem. A lack of root access seems irrelevant to an individual user.

Android is more secure by not acting like a typical Linux install; it's not really evidence of Linux being a tricky target.

> Why would you need root on a typical linux system? A program running under your user account can alter config (in your home directory) to make sure it always runs when you log in, can add programs to your path by altering your path, can access all your personal files and can debug-attach to all processes and do what it likes with them (and your personal data) in order to spread mayhem. A lack of root access seems irrelevant to an individual user.

All true, but I guess I'd just say that the main difference is without root, recovery/removal of the virus is fairly simple (as is detection). To recover, reboot, login as a different user, restore the .bashrc/startup configurations to default, remove the virus. Done.

If a virus gets root access, really the only safe way to recover is a full system wipe and reinstall.

But I would say that typical linux is more secure than android. It's fairly uncommon to install software from untrusted sources. On debian, I'd do an `apt install xyz" for most stuff. I'm not typically just installing unvetted software from the internet, certainly not something emailed to me.

Android basically doesn’t rely on users and groups in a traditional sense for security. Most of its security model was bolted on top of Linux.

Reply on news.ycombinator.com