Item — HN Reader

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious.

For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

> The problems listed on the page are real and we should tackle them.

Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them.

> Instead security should be treated in a systematic way

As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety.

> Security is not an app to be installed. It's an architectural problem.

Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop.

> Namely, are distro maintainers qualified to verify antivirus code?

AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands).

> They also commonly run with elevated privileges (the point about sudo).

That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

2 comments

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

Is it actually working for Windows? Especially for programmers.

"Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.

Avast itself recently became malware and got its extensions pulled. Another reason for architectural security is that every third party program capable of updating itself has one unfixable vulnerability: the almighty dollar. A company gets bought out or an individual gets bribed and suddenly a stranger's in your house.

My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.

Well, 2020 was not a year of Linux of desktop. How many people use Linux AND fail to notice obvious signs AND download malware/viruses common enough to be detected by antiviruses?

Did they download a random anti-virus program from the net?

Which ones are the secure ones?

How did they know it was avoided? Did a popup from the software they installed tell them so?

Noticed a popup "Malware has been disinfected" and the bad files were automatically moved to a quarantine. Don't remember the AV which was used.

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

Does it work though? What evidence supports this claim? I use Windows with no AV and I've been having no problems. Mainly because I don't install software from shady sources. But I know people who install pirated software, because they can't afford it (a common situation for e.g. architecture students), or pirated games and use an AV and after some time their computers become universally unusable, because of course they got a load of malware. AVs do not protect them. Builtin security mechanisms in Windows (such as UAC) bring a lot more benefit to me than AVs bring to those who pirate software.

> Considering the number of breaches of NPM/Rubt repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them.

People obviously are doing something. Effort is going into Wayland, we continue getting new Linux namespaces in new kernels, firejail is under continued development, some people rewrite their apps from C to Go and Rust (newsboat, coreutils for Debian recently), even more of them gets written in one of those languages, when started from scratch.

It may be that things are moving a bit slow, but such is life in FOSS. NPM doesn't have anything to do with Linux Desktop. If Linux Desktop relied on NPM for security, it would be obviously broken (since distributing software any other way would sidestep NPM mitigations).

> You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety.

Again, I would like to hear what exactly a Linux AV would do. Just compare file checksums against a db? What system APIs would it use? How is an "antivirus" superior to a sandbox? How would it be able to prevent Xorg keyloggers? How would we audit it?

> Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop.

It is exactly what you can do with firejail. The issue with Xorg and firejail is that there is a socket to the outside world that needs to be available in the sandbox for any X apps to work, and then all Xorg issues are available. But that's a flaw of Xorg, not firejail.

> AV vendors have a reputation to keep.

Just like Apple has a privacy reputation to keep, yet doesn't provide end-to-end encryption for the data which is sent to iCloud. They still get to be "champions of privacy". Just like Zoom has a reputation to keep and had a major issue in that regard as well. If it is proprietary, then I have less of a reason to trust it, not more because of a "reputation".

> That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

The way to protect against malicious code in the kernel is to move as much code out of the kernel as possible. I certainly don't feel more secure by having more proprietary code run with elevated privileges.

Overall, if Linux security issues cannot be solved systematically, then I really doubt they could be solved with an antivirus. A better bet at that point would be ditching Linux for something else. (In the future maybe some operating systems will be built on seL4, which is promising.)

> How is an "antivirus" superior to a sandbox?

This. If you really care about protecting your system and not about security theater, consider security through compartmentalization, like Qubes OS does.

> Overall, if Linux security issues cannot be solved systematically, then I really doubt they could be solved with an antivirus.

No one is arguing with that but a native AV for Linux could potentially add a layer of protection.