State of Linux Desktop Security

There is also Qubes for security sensitive work

https://www.qubes-os.org/ https://www.whonix.org/

Still, I like the point/aim author is taking.

> Windows and MacOS enforce signature checking on all binaries.

This is not a meaningful security feature. If the signature has to be from the manufacturer then you can't so much as write your own shell script, which is useless. That is a cage, not a security measure. But if the user can sign their own binaries then the signature is the equivalent of the execute bit -- you have to tell the system something is executable before it will execute it. Linux has had that forever.

Well. The principle of Linux was and still is to give tools and have users use them. It gets out of the users way to use them. One can always use firejail or other sandboxing solutions to do that. Chrome itself is a security nightmare, always with the mic on and listening. Microsoft and Apple also have CVEs unattended. Binary checks before starting a program? Why I have a package-manager that does the checks. Untrusted binaries are ususally installed with local user rights in a seperate path or best, not run at all(never needed to turn to some website offering tools since moving to linux aeons ago). Not all distros use Flatpack or Snap, and I hope it remains that way regardless of how fiercely Canonical is pushing for it. Granted, the out of the box security provided by Linux as a Desktop OS is behind the Windows/MacOS one;Only think of the non-existing firewall rules on a fresh Ubuntu installation. But I think that is ok, because installing Linux is a conscious decision, unlike using a preinstalled Windows or MacOS. So, if you do that move from one OS over to another, the user should read up and not expect the community to hold their hands without asking questions.

Not everything is perfect, yes moving the toolchain would be nice, but then again, most a community run projects, so the user needs to know about locking their basement as well. Hence the audience is/should be more technical minded anyways.

IMHO another post about comparing apples and oranges leaving out second-level effects. Just an example: Looking for CVE-entries https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=MacOS , https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux , https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows . We see that MacOS has the fewest and Windows the most CVEs. (So it doesn't matter that Microsoft closes the CVEs quickly and Debian might take some time (haven't really run metrics on that one), there is a huge attack-surface on Windows, compared to Linux and new once have to pop up all the time :D) That isn't looking into severity, because a chaining of medium CVEs might also lead to a compromise as well ,and not everything requires system or root. User might be fine as well. I see a reflection of favoured OS. Only few people use MacOS (some artists, companies streamlining their assets for maintenance and rent,etc.). Windows, on the other hand, was always the big dog on the desktop market. Naturally, maleware authors focus on the biggest market.

I'd rather shit Legos than have to deal with binary signature checking.

Right. Or where it matters less, VirtualBox or KVM.

And where it matters more, hardware compartmentalization.