Hi all!
I am a person with an interest in cyber security. I am not sure what section this would go best in so sorry if where ever it ends up isn’t correct.
I’ve been reading up on cyber security recently and I’ve come across some criticism of Linux Desktop operating systems as being very lacking in various areas and I was wondering if perhaps someone could enlighten me on the validity of these criticism? I am not interested in debating operating systems. I am a linux fan, I will always be a linux fan, and honestly if I were a betting person my money would be on the weakest security aspect of (almost) any computing experience would exist between the chair and keyboard. That said, I would at least like to be aware if these criticisms are reasonable or if these claims are being made in bad faith.
The first claim is that sandboxing on linux is either non-existent or weak enough that it may as well be non-existent. It compares linux to the sandboxing on Win10, Mac, and ChromeOS.
The second claim is that linux has near zero exploit mitigations compared to, “any other modern OS.” On a personal note, I feel like there is a significant bias here, because it credits Windows and Mac to, “Moving toward memory safe languages” while noting they are still “mostly written in memory unsafe languages.” Then criticizes linux because, “enabling rust does not imply it will be used.” This stinks of a double standard to me.
-It does go on to discuss some level of specifics and makes the claim that Windows and Mac have better protection against a buffer overflow attack through use of arbitrary code guard and hardened runtime. I feel like this is more factually based
The third claim is that the linux kernel itself is lacking in security. It claims there is a colossal amount of code all running within the most privileged areas of the operating system. It claims linux implementation of new features worsens an already large attack surface.
In fact, there are so many bugs being found in the kernel, developers can’t keep up, which results in many of the bugs staying unfixed for a long time. The kernel is decades behind in exploit mitigations, and many kernel developers simply do not care enough.
Are these fair and reasonable criticisms of linux security issues? At least one article doesn’t out right say it, but it at least heavily seems to imply that security is nearly a lost cause on linux because the level of things needed to do to secure linux would break all compatibility with the current linux ecosystem.
I am solely asking out of what I would describe as a ‘professional interest.’ As I said at the top, were I a betting person, I’d wager the biggest security risk is between the chair and keyboard for most mainstream operating systems, still I would like to try and maintain a reasonable awareness of what is going on under the hood as much as I can.
