True story, Linux sees MIME types, so if Hot.Chick.Blows.Brother.mp4 is a virus, it shows up with a Windows (MZ) binary icon, not a media icon 😉… unlike Windows which only recognizes extensions 😒.
Microsoft, in their infinite wisdom, also decided that file extensions should be hidden by default. So you won’t even see that you downloaded TaylorSwift_1989_TaylorsVersion.exe instead of TaylorSwift_1989_TaylorsVersion.mp3 unless you changed that setting ahead of time.
Wait… Real?? I guess its always been a part of the first round of changes I’ve always made to Windows. Crazy how much I’ve normalized fighting the software I use.
Anyway, that’s wild. What a just bad and unsafe decision.
See, this is mostly because of 2 things. One, when changing filenames, users make the stupid mistake of changing the extension as well (having no extension that is), which of course, in Windows, it means the file won’t be recognized as a media file. Two, blind you from the truth - you don’t want users that can think, that’s not what our bysiness is about 😏. Also the reason behind why Windows has less and less options and people that want to change something have to revert to registery hacks to do so.
And this only gets worse, since audio file tags (and I believe video files as well 🤔) include album art nowadays, so it has an icon that is the album art… exe’s also have custom icons, so 🤷…
My memory is fuzzy and I don’t know the correct words to research it, but I am pretty sure that depends on the DE.
Either KDE Plasma (dolphin) or GNOME (nautilus) uses the extension iirc. Maybe that changed though.
That’s not a Linux thing. It’s just whatever desktop shell you chose to use and various shells behave in various ways. The reason this might be safer in most Linux distros is that you’re discouraged from executing things under a privileged user which means that malware can’t make significant changest to your system easily. If you do the same in windows, you’d be just as safe.
Not exactly… I mean, yes, you’re right about the privileges thing, but Windows has a lot more security holes than Linux (or any POSIX based OS for that matter). The root of the problem, as always is the distant Windows relative, DOS… no user space notion whatsoever… and Windows NT has dragged these issues for decades now, all because MS made (bought) DOS and distributed it.
With increasing amounts of people, organizations, and governments adopting Linux, we’re no longer as safe as we used to be. Unfortunately, we might have to get virus/malware scanners now like Windows users.
OSS is a double edged sword. It’s great, but the people looking for flaws that are exploitable are more often bad actors than good. At least that’s been my experience working in cyber security. Many CVEs that are responsibly disclosed are found to be actively exploited already.
Probably years of usage by intelligence agencies and criminals until someone notices. (with no possible way to know for anyone that there even is a exploit). And even then it might take months for them to fix it.
Exploit found in oss: Depending on the usage of the software several people are looking for security holes and they usually get fixed ASAP. Of course it is possible that there’s an exploit nobody finds and a criminal uses, but it is not more likely because he can read the code. If your code must be secret to be secure your code is anything but secure
Also there is no incentive for companies to fix an exploit quickly. They will only release the fix with some scheduled update anyway or else people might notice that there was something worth fixing and that's bad for your stock price.
There are a lot more ways to sneak malware into a system. Especially if some apps aren’t being maintained anymore. Linux is definitely safer, but you shouldn’t let your guard down
especially if you’re a developer. There are a lot of shenanigans going on with malware npm packages that prey on easy typos. I imagine it’s the same with other library installers for other languages too
Possibly, but Firefox & Chrome based browsers have the same built-in isolation and other security measures as on Windows. Plus you can use Ublock Origins to get rid of malvertisements. If you really wanted, you can also isolate the browser entirely with something like firejail.
Hardend forks like LibreWolf are good too.
Oh, and Wayland also isolates clients from each other too.
I don’t think it’s that big of a threat as long as you keep some level of common sense.
Oh, and Wayland also isolates clients from each other too.
One of the biggest reasons I might want to say goodbye to xfce sooner than later.
I can’t make use of most of Waylands’ features and improvements, but this kind of isolation is very much worth it anyway.
Okay, what happens if your repo doesn’t have a specific software you are looking for? A trusted repo is good, but it won’t have everything you might want. This is especially true for new software or less popular software.
I don’t think that’s the correct path. There is a scanner already, called ClamAV, which works well enough.
Virus scanners don’t fix the problem though. Android does it better: security by isolation and verification of system components.
The most important part in malware protection is whoever sits in front of the screen. Systems like Android have so many safeguards in place, the only way to get a virus is the user forcing it through themselves, pretty much.
I’m surprised it hasn’t seen wider workplace adoption.
A call centre I used to work in once scrapped all our Microsoft Office licences and installed OpenOffice on everyone’s workstations to cut costs. It was bad for the MI staff because they relied on Excel functionality that OO Calc simply didn’t have, but the vast majority of staff could get by on OpenOffice.
My only real criticisms of how they handled this was not giving people any notice, and making us use a shitty webmail app that only booted in Internet Explorer and would sign you out after a minute of inactivity to access our work emails. They could have easily installed and configured Mozilla Thunderbird to give us some quality of life that Outlook once afforded us.
Also this happened a few years after Oracle got their hands on OO, so not using LibreOffice was also questionable.
But still. Think about the shitloads of money you’d save by using Linux in the office.
There’s already a ton of such exploits. Most servers use Linux and many exploits of corporations this had to go through Linux (though many exploits aren’t related to the OS at all – eg, SQL injection is OS independent). I expect it’s more common, though, that attacks on Linux systems are either meant to target servers or were personalized attacks that you’re not gonna accidentally download.
On that vein, I also kinda suspect that many people who use Linux may be bigger targets for their employer than their personal PC. Which is actually scary, cause personalized attacks are far harder to defend against. I expect the average Linux user is technically savvy. Not a lot of money in try to do a standard, broad attack on such types (I think most attacks on personal computers are broad attempts that mostly depend on a small fraction of technologically incompetent people falling for simple schemes). But a personalized attack that happens to infiltrate a fortune 500 company? Now that’s worth a lot of money. Using Linux won’t protect you against those kinda attacks.
The cruder the malware, the better your chances of running successfully in Wine.
Because throwing together some simple executable using inbuild windows functions is much easier than programming something well-build and hidden based on deeper system layers. So your random "I just encrypted all your files because you clicked this .exe, now send me bitcoin to get it back"-bullshit might work well on wine (which is why wine should be run as it's own user with no priviledges to access anything but your Windows programs).
Well, anything unpopular that doesn’t use any software (even low-level software) that is also commonly used in popular environments. For example, game consoles, embedded devices or car entertainment systems often use outdated versions of popular browser engines. So to hack these, you don’t need to be a highly skilled hacker, you just need to be able to try some older vulnerabilities.
And there are enough malicious websites that will just automatically check for these vulnerabilities. And then it’s enough to accidentally open one of these malicious websites and even though nobody wrote the hack specifically for your car, you might catch some malware regardless.
For example, when GNU/Linux was unpopular, there was no malware for it; when it became the world’s favourite server software or became a valuable target
I’ve been using Linux for almost 20 years, and AFAIK in all that time I’ve never encountered a Linux virus. OTOH when I run Windows, I hit a virus within the first six months.
Sounds like you have bad habits, I’ve had windows for years and no problems. Just scan with Defender after a download, occasional Malwarebytes scans to make sure, and you’re pretty safe.
Most viruses are written for windows but that doesn’t mean you’re just instantly safe. You can bet as Linux grows they’ll see far more.
Yeah last time I had a windows virus was because I got a bad Photoshop crack. But the virus was just a coin miner. Before that, I hadn’t had a virus in 13 years.
With how much Adobe infects a system, leaving multiple different traces behind even when uninstalled, I think it’s fair to say that Photoshop itself is almost a virus
Genuinely, how can you get rid of all that? How do you even find everything?
The Win10 iso that I definitely legitimately purchased has a ppApps folder that has Photoshop in it; I’ve always just assumed I would be able to delete it from there.
If you don’t have it portable-ized, though, Revo Uninstaller might help. (though I never used it for long enough for the trial to run out, so I don’t know how much it costs)
— When the Indian Amazon support guy sees you’re a junior on your first week and tells you to execute a script to install a software for a video call with him. And you do, but it needs sudo access, so you give it…
— You have sudo power here
Sadly, true story. I never told anyone. My neurons clicked a day after that and I removed everything from the computer. It was too late, they hacked some things but IT just laughed and recovered some backups. They never knew I was the virus all along.
Add comment