Ubuntu – Is Linux getting less or more secure?


The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more secure?

I know:

"No computer or network system is 100 percent secure. There is always a vulnerability in every system."

Best Answer

A system is never 100% secure and there are always vulnerabilities, in every OS. Some are known and some still want to get discovered though. It's a fact though that the UNIX/Linux security architecture (from which also Apple's OSX is derived) is much stronger than the one Windows had in the past and I believe it's even still slightly stronger than what they have nowadays, although the difference got minimized.

The advantage of a system with a very low user count is that hackers (only speaking of black hats that want to attack you) have a pretty small interest in spending their time on Linux, because even if they find an open backdoor, they can't make much profit with it as there are too few potential targets.

So the more users an OS has, the more interesting is it for people with criminal powers to find and exploit vulnerabilities. This however means also, that more white hat researchers will check it out and fix some of those problems. So there will always be a balance between white and black, though experience shows us that the dark side usually has a slightly higher growth rate.

However, the OS itself is not getting more insecure or vulnerable once there is a high user base. The weak points remain the same, they just were not known earlier. But as knowing a problem is required to be able to fix it...

However, it's not really correct to say that Linux in general has a small user base today. Desktop computers mainly run Windows and no Linux distributions, but that's not the only type of computer we have. A majority of the web servers operate on Linux as well as e.g. the Android OS for smartphones is actually Linux-based. These systems all have major differences, so a hack on one would probably not work on the other, especially as installed Software is much more vulnerable than the system/kernel itself, so an attacker would rather try to break into that or trick the user.

Additionally (thanks @Rinzwind) it's also important to say that Linux systems in general can be seen as systems for advanced users (total computer noobs probably haven't even heard anything about it yet), whereas Windows is just what everybody uses, no matter what skills he/she has, as it comes preinstalled on almost every machine nowadays. This is important because many attacks depend on vulnerabilities of the interface between keyboard and chair, also known as "The User". Of course, many also just think they're experts and pay even less attention when downloading .deb packages from websites or compiling foreign code from source, because they believe the myth of "bulletproof Linux". So just copy-pasting sudo commands or installing Software as root is and stays dangerous, because Linux systems are not designed to protect the user from themselves!

*"It's not UNIX's job to stop you from shooting your foot. If you so choose to do so, then it is UNIX's job to deliver Mr. Bullet to Mr. Foot in the most efficient way it knows."* - Terry Lambert

To conclude we can say that higher user numbers make the OS more secure in theory, as more vulnerabilities are detected and fixed, especially as it is Open Source. But practically this also increases the number of attacks, as it becomes a more interesting target.

The system itself is however usually the strongest part of the security chain, the weak parts are vulnerabilities in additional software (browsers, flashplayer...) or the users themselves, as it's easy to trick non-experts and let them install malicious programs or run evil copy-pasted sudo commands.