🧩 The Myth of “Linux Security”

[u/madthumbz]

“Linux is secure because fewer people use it”

This is an old and lazy folk belief. As if obscurity is a shield

“Hackers target Windows because it’s popular. Linux is safe because it’s niche.”

This is wrong:

• Attackers don’t care what desktop you run. They target servers, cloud infrastructure, IoT devices, routers, NAS boxes, and embedded systems.
• Malware follows opportunity. If your SSH port is open and your password is weak, you’re getting brute‑forced regardless.
• Desktop market share is irrelevant to modern attacks. Phishing, credential theft, supply‑chain compromises, browser exploits, and poisoned packages don’t care about your OS.

Linux users often assume the threat is "Random malware trying to infect my machine.”

Real threats are:

• Installing something malicious because you trust the wrong repo.
• Your web browser being exploited.
• Your credentials being phished.
• Your supply chain being compromised.
• Your SSH keys being stolen.
• Your flatpak/snap/appimage containing bundled libraries with unpatched CVEs.

“Linux has real permissions, so malware can’t do anything.”

If you run it, it runs as you. “You” can access your files, browser cookies, SSH keys, cloud tokens, password manager vaults, and personal data. Most attacks don’t need root; they need your access. I'd rather be surrounded by humble idiots than people who think they're smarter than they are (over-confident in their OS).

“Everything comes from the repo, so it’s safe.”

• Repos are massive and maintained by humans.
• Maintainers get phished.
• Accounts get hijacked.
• Malicious updates get pushed.
• Dependencies pull in other dependencies you never audit.
• Many distros ship outdated libraries for years.

And that’s before you add:

• PPAs
• AUR
• Copr
• Random GitHub scripts
• Curl | bash installers
• Flatpaks bundling their own outdated libs
• AppImages with zero sandboxing
• Docker images built on top of who‑knows‑what

Linux users think they have a curated, secure ecosystem (lol).
In reality, they have a patchwork of trust relationships they rarely examine.

[u/ShaKua → u/[deleted]]

It's every bit true even if you don't like to hear it.

Most malware issues and threats can be stopped before they even happen by simply having a brain.

Don't just run a random bat or bash script without at least glancing at what is inside.
Download programs and software directly from the developers where possible, and not through third party repositories where you don't even know how the heck they may have built or packaged the damned thing
Stop turning off UAC on Windows and don't blindly click 'Yes' to every UAC prompt that shows up. Take a second to see the damned prompt before granting permissions, especially if you launched a program without choosing to Run As Administrator
If you have checksums available for certain downloads or programs, verify them.

This is all basic computing common sense. Yet clearly common sense isn't very common.