Few windows users get their software from the Microsoft store where store apps would benefit from sand boxing in the first place. Instead they cruise the web with their web browser hoping that the first link on google for "foo" is the official source of foo not a link to one contaminated with malware. Good thing the odds are pretty good unless foo costs money in which case they are searching for "pirate foo" and now 99% of the links are in fact malware.

Once they find the exe or msi of their choosing is found they quickly double click on it and answer yes to any prompt that comes up regardless of whether it asked for admin rights or to sell their kids to a veal farm.

Fortunately they have an antivirus to catch them if they do anything stupid. Unfortunately so do malware authors who will carefully craft their wares to bypass such protections while the antivirus will spastically check every file that is opened and everything the computer wants to do before it lets it do it catching only the dumbest malware while ruining performance.

Meanwhile Linux users can get all or virtually all software from a single app store which actually contains all or most of what they need. Not installing malware remains a vastly easier solution than trying to contain malware you are stupid enough to install.

> Linux is now the least secure desktop OS available,

... less secure than Haiku, the OS that runs everything as root?

> with limited sandboxing

With limited default sandboxing (snaps, flatpaks), and assorted add-on options (firejail, bubblewrap), in which respect it's... exactly like NT (sandboxie) and Darwin?

> and no provision for checking binary signatures

I am aware of no package manager which fails to check signatures before installing. They may exist, but at least the major players do.

> Linux is now the least secure desktop OS available

[citation needed]

> limited sandboxing

seccomp? Namespaces? What exactly do you want Linux to be able to sandbox that it can't?

> no provision for checking binary signatures

Bootloaders already enforce this for the kernel, and the kernel can enforce it for its own modules. Userlands are free to enforce it for userspace programs (e.g., how Android requires APKs to be signed).

Those are toolkits to sandbox processes, but I'm talking in terms of complete solutions. Linux has Snaps and Flatpak, but the modern distros lack in solutions to enforce sandboxing policies systemwide against arbitrary binaries.

While Apple's Gatekeeper and Windows Defender may improve security, their privacy drawbacks are substantial, and as we discovered recently with Apple's Gatekeeper fiasco, yet another thing that could fail and prevent legitimate programs on the computer from opening. Furthermore, Windows Defender will occasionally quarantine binaries and DLLs that are harmless. For a non-power user, fixing these problems is non-trivial. Privacy vs Security is one argument, but the fact that the systems can occasionally break through no fault of the user is a major concern in its own right.

Limited sandboxing? Ever heard of containers?

What mainstream user software is distributed as a container? Last time I checked it's all just endless deb files.

You should check again - Ubuntu applications are now being distributed via Snaps that everyone hates, they are sandboxed tho. For other distributions you have Flatpak that is also sandboxed.

Spotify, Blender, Chromium, Firefox.. The situation has improved immensely over the last 4 years.

Windows is probably considerably more secure against browser 0days, but how much malware is actually distributed that way? I expect most of it comes from people manually running malware executables they mistakenly download from websites.

First off, you are right in that Linux has major security issues and isn't perfect in it. However, outside of the comments that have already been posted in defense of linux's security, in the end, Linux's relative obscurity at the moment DOES effectively lead to less viruses. Compare that to Windows, who for all the security measures they implement ultimately lead to more because it is simply more targeted. While this isn't truly reliable security, at the moment it works better.

Either way, Windows compromises all of your data nonetheless. So not only are you actually getting viruses, your data's stolen anyways. Compare that to Linux, where viruses aren't as frequent and no ones siphoning your data. In the end, who's better off?