OSNews

As much as I would like to agree, having a false sence of security because we run linux is dangerous. Yes, there might not be any (real) virus for linux out there, but I still don't want to be a vector of transmission by giving infected files to other computers. Of course we wont have any threat if we us something nobody else uses, because, well, nobidy care! Now that allows me to surf the web and laugh at attempts to highjack my IE or even Safari, but that does not mean that my 3 years old unpatched firefox is more secure then the sandboxed,firewalled,antivirused IE 8... Often, when advocating linux, I ear people saying that it is more secure and does not need antivirus. This is a dangerous idea of false security. "

Firstly, antivirus isn't security. Antivirus is trying to detect and remove a security breach after it has already compromised your system.

Secondly, the correct method of installing software on Linux is via the package manager. Package managers and the associated online repositories allow for a system where any piece of software can be audited and verified by any person on the planet. Anyone at all, not just the person who wrote the software. If everyone on the planet can see what is in a piece of software BEFORE it gets to end users, this makes it very difficult indeed to hide malware within that software.

Finally, one should examine the record. The record is AFAIK impeccable. AFAIK (and no-one has yet been able to contradict this) ... there has never been an end-user's system compromised with malware via installing open source software from package managers.

PS: On Linux, all programs by default run as a normal user. Running firefox on Linux means running it as a normal user, and hence it has no ability at all to modify or create system files or directories. All programs run as a normal user on Linux are effectively sandboxed.

Edited 2009-11-10 23:07 UTC

The "package manager and associated online repositories" doesn't work with commercial/proprietary software, where you don't have the source code. The best that an auditor can do in that case is GUESS whether the software contains malware or not; for example, an application may only reveal itself as malware under timed conditions (only destroying your machine or turning it into a zombie after a period of time). And, since there is an unquestionable need for commercial/proprietary software, you don't have a solution.

Edited 2009-11-11 01:14 UTC