do you really believe that they AREN'T working on this? of course they are. the field of software development is extraordinarily young. we still don't know how to do things very well, and we're still discovering new ways to know we aren't doing things well.
> Linux and BSD machines manage it.
it's a matter of target value, and the number of people who would be inconvenienced enough to pay a random to unlock their files on Linux is FAR smaller than for Windows. So attackers go where the money is. Governments overwhelmingly use Windows as a desktop OS as well. Attackers go where the secrets are. etc.
And when you count remote exploits capable of remote code execution, last I read there had been slightly more of those on Linux than Windows. don't quote me on that until I find a source.
> Remote 0-days don't come by that often.
yes they do. not all of them get media attention, though. the most recent monthly patch from MS for Windows 10 included fixes for six of them. All were actively being exploited. SIX.
But does hijacking of servers create that kind of publicity? Sometimes companies have to admit that they have been hacked because of data leak. But do they publicly admit for every breach? Is it in private companies interest to go public with that kind of information? And if they do, does it reach non-technical newspapers?
There was a good thread about Linux kernel security today, a slideshow and video. TLDR; many unsafe practices because of C, bad project management to track bugs, triage bugs, correctly applying patches, correctly map patches with CVEs