Why is linux more secure than Windows?

[u/The-Numbertaker]

I'm considering making a second PC and using Linux at least for some time because it's free (and I kind of want to try it anyway), but I would have expected that it (open source distributions at least) would be less secure than windows, not more, since I would have expected that being open source would make them an easier target for those who wish to find and exploit security vulnerabilities.

I'm guessing that must be wrong seeing as it's considered as more secure, so why is that the case?

[u/fellipec]

I would have expected that being open source would make them an easier target

This was the typical FUD that was spread in the late 90s. The truth is inverse. With so many eyes on the source code, exploits are usually fixed, backported and distributed promptly.

You can read more about the subject here:

• https://linuxsecurity.com/features/how-secure-is-linux

• https://ubuntu.com/blog/is-linux-secure

Also important to notice that nothing is 100% secure. Every system will have exploits and bugs. But the Linux community is based about cooperation and transparency so you should expect the flaws found to be fixed and published ASAP. When we deal with closed source software, bugs could lurk in the code and be used for much longer.

[u/_star_fire → u/fellipec]

And we must not forget that in many cases people are the weakest link. By not updating their systems, having weak passwords, disabling security features because they're annoying etc.

[u/Due-Week8712]

The main thing that linux security relies on is there being much more "good eyes" than "bad eyes". Meaning there are always more people looking at the code in order to fix potential security exploits then there are people looking at the code with malicious intent.

[u/sekoku → u/Due-Week8712]

Exactly this. Linux is no more/less secure than Windows. It's just Open-Source, which allows people to view the programming code and audit it themselves.

Someone tried to sneak a back door into SSH, for instance, and it was caught. But if it wasn't before that point... it would've been bad.

[u/senectus → u/sekoku]

Linux is no more/less secure than Windows.

Not entirely accurate.

By default Linux does not ship your information back to a Corp Mothership like Windows does.

By default Linux does not play you adverts that also harvest information from you like Windows does.

By default Linux doesnt require you to sign in to a "cloud account" like Windows does.

By default you can CHOOSE to not install all sorts of apps and services, unlike Windows.

Security is more than just "open ports, firewalls and vulnerabilities"

[u/Any-Virus5206 → u/sekoku]

I agree with your point, that’s definitely a big part of it - but I do also think Linux has genuine merits to stand on.

For instance, Linux distros have been heavily adopting sandboxing for apps via Flatpak. Of course Flatpak is far from perfect… but it’s a big step forward and there’s not anything like it I’m aware of on the Windows front. Also things like having to make scripts executable before running them, etc…

[u/[deleted] → u/sekoku]

[u/Maberihk → u/sekoku]

This is not the case. It is due to the follow system architecture. Linux which was based of system5 unix as file system permission built into the core kernel and everything above it relies on the kernel permission service. Where as windows had msdos originally and then they added permissions in windows but not at the dos level. Later they brought in ntfs but this was to enlarge the file space and support larger storage. And included a level of permissions. But it needed to maintain Tain. Backwards compatibility. And windows needed root permissions to do its work. Rather than the Linux version where its gui was its own user in the file system. So there is the reason. Of course open source allows improving and secure tech. But the best engineers in the world will struggle to secure a compromising and broken core.

[u/Bourne069 → u/sekoku]

XZ backdoor still effected tons of people that had the nightly build where the backdoor was indeed pushed too... it was just caught before it was pushed to stable branch.

And more like this will happen. XZ backdoor was only possible because the main contributor backed down and another one took his place, that person was the one that created the backdoor. This can literally happen with any Open Source software. Nothing stops it from happening other than the main contributor and he can do whatever he wants with the software, like sell his position to a bad actor or an incompetence company that continues to development with bad practices.

[u/SpaceCadet87 → u/Due-Week8712]

It helps that the "bad eyes" also need a secure operating system, probably even more so that you.

[u/[deleted] → u/SpaceCadet87]

I worked for a company that got hacked and then the hackers got hacked. They definitely need security as well.

[u/Curmudgeonly_Old_Guy]

One thing that hasn't been mentioned here:
Linux browsers are not part of the OS. You can remove the browser from your Linux system and the rest of the OS works just fine. If you get a virus in your browser you can delete the browser, take an extra step or two to make sure all the configuration information is actually gone, then reinstall and go on with your day.
In Windows every browser is an integral part of your OS, if your browser gets a virus your whole OS gets a virus.
You simply cannot have Windows operate without a browser (you can suppress it, so that it doesn't appear to be available to the end user, but it's still there).

On the other hand:
Windows will straight up lie to you about how the OS works and how to accomplish certain tasks within Windows. For proof of that look into how to disable AI Copilot in Windows. (Spoiler it's still active just not apparent after following Microsoft's instructions on how to disable.)
There are several hundred Linux distributions available, some very purposefully insecure, some designed with security given much more emphasis than usability, most somewhere in between.

[u/FunEnvironmental8687 → u/Curmudgeonly_Old_Guy]

Browsers don't magically get malware, and nothing you said is accurate or relevant. On Windows, I can simply delete the Edge configuration files to reset it to its default state. The same applies to Linuxreinstalling the package wont remove configuration files, so your argument doesnt hold up.

Edge on Windows is arguably the most secure browser, with the highest number of exploit mitigations enabled, thanks to its deep integration with the operating system. Features like "Super Duper Secure Mode" (admittedly a terrible name) significantly reduce the attack surface by disabling features like JIT, which is responsible for over 50% of exploits, while also enabling advanced protections like ACG, CIG, CFG and CET are all enabled in the renderer process, which are not present in standard Chrome or Firefox.

[u/MulberryDeep]

Because linux ≈5% of desktop marketshare and most of its users are tech savy

So this results: The gullible old grandma is not the average linux user and programming a virus for linux would be not benificial because of the low market share

Also open source lets everyone read the code, so if its a somewhat widely used programm, somebody will find the virus in it (if it has one)

[u/no_brains101]

a few things, in rough order of their impact on security:

1, desktop linux users are generally not idiots who click all the links. (and also they havent had windows training them for years that clicking random links is how you download stuff)

2, the link they clicked downloaded a windows virus

3. most linux machines are servers, so, 1 and 2 above also apply, but also because you have full control of whats running on the machine, you can ENSURE that the only thing running are the things needed for your program, and the kernel. Being able to control your attack surface is EXTREMELY important.

4, linux doesnt have a bunch of random stuff running in the background and a bunch of open ports by default, by default it usually has NO ports open, and if your distro does have stuff running, you can actually stop it from doing that, without it magically undoing itself on the next system update.

5, desktop linux users usually use package managers, and most package managers contain pre-vetted software. Usually this is fairly effective in at least preventing malicious contributions but catches a vast number of accidental security-related bugs as well

6, linux has stronger file permissions than windows, especially with SElinux but even without that, and has better defaults for file permissions as well.

7, People consider it secure, because we can all see the code. Any company who wishes to make sure their software is secure, can go and look at it. Microsoft has a lot of people. Linux has just as many, but then it ALSO has all these companies looking at it on their own time. For example, microsoft. But linux also has orders of magnitude less code in it. This means on average, each line of code in linux will have orders of magnitude more eyes looking at it over the years. Especially because ANYONE can go and look at it, and not just microsoft employees.

8, Linus has REALLY high standards

9, windows wants your data. Some of your info leaves your machine by SOME mechanism. Can someone else use that? It also has auto updates by default and we KNOW other people have been able to use that.

---

Ultimately, a decent amount of it is security by obscurity, but there are also real reasons

The biggest one, we have NO idea if windows is at all secure. For all we know, there are monster bugs in windows that we just arent allowed to look at, in which case, windows would ALSO be security by obscurity. But we cant know. We are not allowed to know.

The only way for an outside party to audit windows security is to spend big money on pentesting it. On linux you can literally just tell 2 of your employees to go audit the linux kernel modules that you use on your servers, and they can go download it, look at it, and poke at it with full ability to see the inside, maybe even in a debugger. And there is SO much less code to look at so thats actually somewhat reasonable to do.

---

In the end though, the more interesting explanation is this.

Software engineers are engineers and they REALLY like to build systems.

Software is complex and requires a systemic approach to building it.

So software engineers built systems to be able to recieve changes, review them, and accept them if they are up to par, and have written systems that also perform some automatic checking to see if they are up to par as well.

These systems dont require a company to continue functioning. Well, it requires the internet to work and someone to host a git server, but, no specific company is required for that software itself.

[u/kbielefe]

Part of it is there is no huge Linux conglomerate, so something like a wordpress vulnerability isn't blamed on "Linux" even if it's actively being exploited on Linux systems.

Part of it is the user friendliness <--> security trade off. Most Linux systems come with only the ssh port open by default, if that.

Part of it is open source allows for a trusted package repository. It's not impossible to get a malicious package into a mainstream repo, but it's a lot more difficult than setting up a typosquatted download page.

[u/pocketfulofrage]

Open source allows for anyone to view the code and offer patches/improvements/fixes/mitigation/etc for any vulnerabilities found, whereas closed-source doesn't allow for any external input - patching has to be done by the company after-the-fact.

Additionally, there's no hidden telemetry that can expose your data outside of your control.

[u/[deleted]]

Given the heaps of money poured into windows security, I would argue that windows is more secure if the machine was to be infected with malware. The only true way to rid a deeply infected Linux machine (malware that carves a place through our the system and actively reinstalls itself) is to reinstall the os.

Linux has scanners, but they are not to the degree windows scanners and active measures to detect malicious programs. It's just better there.

Windows glaring issue was it was not designed to be secure. Sure, there are aspects that were meant to help protect the os, the given that a user admin can literally press a button to grant a program full access to the machine is an issue. Also, software was deployed through many different channels. And most users don't understand (and even experienced can have a hard time detecting) legitimate software vs malware.

Linux software typically comes from well moderated and watched central repositories that have been vetted and so will very unlikely contain malware, much like apples App Store and Google Play store vet their apps though Linux distro repos are maintained chiefly by the distro maintainers themselves rather than the app maintainers and apple and Google simply say ye or neh.

So, a Linux user who doesn't need a specific kind of software doesn't need to fight malware distributers in the first place.

Linux also has a policy of don't trust any user. That doesn't mean an admin can't grant a user with full access, but that a user's program needs to ask for it explicitly. With additional kernel hardening like SELinux, even having advance privileges doesn't allow programs full leeway.

Linux containerization like flatpak and Snaps go even farther to restrict programs control. So, a rogue program doesn't get full freedom and requires additional privileges granted by the user. This places the burden of getting these apps to run, but will reduce the likelihood of an app taking over the computer.

Iirc, UWP and related apps that come from the Windows app stores have similar requirements and android / iOS apps also deal with this, but windows apps / games by pass these security restrictions straight up like normal windows or Linux apps, so no additional security there.

At the end of the day, assuming the software has limited security vulnerabilities (like chrome and Firefox do and Linux / windows these days), it's down to the user to ensure malware does not get on the machine. Linux repos prevent random software. Containers add headaches but allow for random software. Windows App store are like a combination repos and containers, but very few people use it so a it's a mute point.

One malware is started on a machine, Linux passive measures help reduce the effectiveness but doesn't eliminate it. Windows active measures helps stop it but doesn't completely prevent it. Once a machine is infected, windows is easier to detect and remove it, Linux will have limited detection and removal.

Though, a full reinstall is very straightforward on Linux vs windows where things maybe more difficult.

And also, windows malware targets users typically where Linux malware targets servers. From an investment standpoint, writing effective windows malware is more difficult (as you need to defeat windows defender and other antivirus) but more profitable than Linux where once on machine you will need to deal with the various distros, software versions, configurations and the passive measures.

That's on top of finding a way onto the machine in the first place which is difficult from experienced users that know where they need to go for software.

Just an aside, assuming the malware can deploy and do it's intention, even if it's later detected by antivirus, you may already be screwed so whether you use an antivirus to remove the software or a full reinstall, it doesn't matter much.

[u/[deleted] → u/[deleted]]

Just additional note, software on Linux varies. You have the normal Firefox / chrome / libre office. But then utilities like for image viewer, video player, PDF viewer, calendar, email client, etc can vary a lot. That doesn't mean users don't gravitate towards certain apps, but distros can choose what apps are default and so they vary. There is shared software in these apps for the most part, but their exposure to different software vulnerabilities vary. So malware that exploits one of these at one version may not work on another. This differs from windows where the software is still wide, but the normalized attack surface is small. You have wide go to local office suite, you have normal PDF viewers, and just standard windows apps. And so you have knowns to work with even if they may get more scrutiny than their open source brothers (yes open source means more eyes and easier to fix by others, but doesn't have the money incentive most of the time).

This is from the infection side, if an app gains user level access (the same access you have when using your computer without admin, which you normally get prompted with a single button on Windows), the app gets access to a lot which can ruin your day, which is why explicit access control permissions in Android and iOS and UWP and in Linux containers which may give users headaches, but are very important from a security stand point. If an app takes over your iOS app, they get access to whatever the app does. It requires additional vulnerabilities to jump outside of it and apple and Google keeps a close eye on that to ensure it doesn't happen. Windows and Linux apps gain full access as a user by default.

So, in a zero vulnerability system, just don't download programs and run them. And you are safe without antivirus.

And saying there will be vulnerabilities so you are never safe, any security vulnerability found in software being maintained by respectable, not overworked groups will get patched. And quickly if it's severe enough. Just making sure your software is update is good enough. The level above that is keep things on the other side of a web browser. The browsers security policies help ensure remote websites, even if they malicious by design, can't hurt your computer (though try to avoid proving it if possible). Next would be to check software to ensure they have been maintained. If a version of the software you're using hasn't received updates in months, then there might be a security vulnerability in at least it's dependencies that may pose an issue. If you remember a while back there was a big vulnerability in libwebp, the Google library used to open webp files on chrome, all chromium based apps (including electron apps like discord) and a lot of other apps, if an app were to be using a version for that library still vulnerable because it wasn't updated, then the app may be exposed and therefore the user and the computer. Ways to prevent that on Linux (which isn't offered on windows) is to containerize and limit what the containers have access to impossible.

Once you hit a fully containerized Linux distro, assuming they are not vms which would be next level, you are probably much much much safer than a typical windows install.

Tie the underlying distro with a file audit tool, and now your entire computers apps can't have free reign if they are malware or are infected with malware, can be easily replaced to remove the malware, and if there was a way for it to reach the os, can be quickly detected for the most part and the os can be reinstalled on the fly assuming you got all your data backed up.

[u/ozone6587]

People think that Linux is secure mainly due to the fact that it's not as popular but Windows just allows you to run any random binary without confirmation. I think that is the biggest reason why Linux is more secure.

Something similar to double clicking a pdf file that is actually a .src file will never happen with Linux users because the OS does not give execute permissions to random binaries. You have to explicitly tell the OS that a specific file should have execute permissions.

[u/subgenius_one → u/ozone6587]

This is the main answer. Most of these other commenters have very little idea of what they are talking about and are just repeating what they have heard.

Any system can and will have some security affecting bugs. However, you should at least expect the intent to be secure. That is to say Linux may not always live up to the standard, but Windows historically does not even try to be secure. Many security features in Windows are purposely disabled or modified in a negative way. See the modifications to MIT Kerberos.

The most practical difference is that Windows determines what files are executable by file ending (.exe). whereas Linux determines what should be executable based on the file permissions - whether the executable bit is set. You can email me the worst malware file or even trick me into downloading it. However, you would still need to convince me to set the executable bit on the file before attempting execute it, because it is not set without manual intervention. That is unless my home partition is mounted noexec, in which case I will not be able to even set the executable bit without remounting the partition.

Sure there could be a buffer overflow in linux, but again we are talking about the system even as designed with no buffer overflows. On Windows, if you click a file with a certain file ending, it will execute with the permissions allowed by the user account.

Also, the velocity of patching is much higher on linux because the programs are generally smaller, and modular. They are usually much easier to patch. The system is way quicker and easier to update as well.

This doesn't even go into App Armor, Mandatory Access Control, etc that are available.

Remote access via ssh and host keys vs rdp with username and password - not even a comparison security wise.

I could go on for days regarding specific technology differences, but you get the idea. It takes a lot of time and effort to really understand the practical applications, but very little of it has to do with 'no one using it' or 'obscurity". What utter bullshit.

Almost every firewall, network switch, phone system, hypervisor, cloud, web server dns server, spam filter from almost every commercial IT vendor runs on Linux.

[u/knuthf → u/subgenius_one]

On Linux we have clear rules for access. There is no "magic back door", there is a front door that can be locked, key made: we have a firewall on "sockets" that tries to connect. As for buffer overflow, we use paging registers differently, and access between apps are not allowed: you cannot "peek" and "poke" into other apps address space, you will get segmentation fault and get kicked out. Shared memory is protected by the file system. In Windows, they rely on "agents" to police and monitor. this has allowed a fleet of "security companies" to be made. Not all of these provide secure service, many are agents for spying, very typical providers of VPN.

[u/person1873]

I'm not sure that there's really an argument to be made about more or less secure anymore.

The primary reason that Linux got the moniker originally was because of the principal of least privilege. Essentially no software runs with any more privileges than absolutely required.

However since Windows Vista, Microsoft has added User Access Control (UAC) which allerts the user and prompts for an admin password when things start asking for privilege escalation.

Linux also has a similar process via sudo/gksu and other pinentry prompts that will show if a process needs greater privileges.

The argument about open source being more/less secure is one that is ultimately impossible to prove or disprove. Fundamentally a successful project should have many many eyes on the code & issues should be caught in code review before PR's get merged. This is most certainly the case with the Linux kernel & libc. However we've seen some instances in recent history of smaller yet equally integral projects being underlined by social engineering & malicious pull requests.

I think it's a good thing for a person to be thinking about, but the answer is far more nuanced than you might expect.

[u/ChocolateDonut36]

1. Linux is less used than Windows, malware normally is developed to work on most machines, and most machines use windows.

2. Linux is open source, if there's any security issue it get fixed instants after it gets discovered.

3. Being open source means that there are no backdoors to give FBI, NSA, or CIA full access to your machine because someone could find it and remove it.

4. because of how Linux manages permissions, if you don't give anyone your password no one will be able to take anything from your system (at least not without stealing your hard drive)

there are more reasons why, but these are the ones I know

[u/TradeTraditional → u/ChocolateDonut36]

The main reason, as stated in a thread above this one, is that the OS will not run random binaries or scripts from websites and emails. What I get is it being confused as the thing just. dies. I suppose as script could forcibly compile something on your machine, but it'd still need permissions and a password to do so.
Windows? One bad ad gets injected into a normal website and suddenly you have popup hell. No warning, no way to stop it. Any old executable of any type has nearly admin access the second it runs.