Most Linux distribution do still not have a properly verified boot chain, even something at the core of system boot like initrd is unsigned (which asks your LUKS password). There are immutable distributions, but they don't use sealed, cryptographically verified volumes. It is still trivial to modify the store in most immutable distributions to inject malware. User applications have no isolation at all, every app that parses untrusted input and does network access can read/write your whole home directory, including private keys, AWS credentials, etc. (most people don't use smartcards). Browsers only have some security because the browser developers have built their own sandboxes, but a determined actor can probably break it without too much issue through hardware acceleration APIs, etc.

macOS as many times more secure than the Linux desktop. The only reason Linux is not a malwarefest is because the market share is so small that it is not that interesting.

[1] https://0pointer.net/blog/brave-new-trusted-boot-world.html

On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.

Why do you believe governments don't have backdoors in the open source ecosystem? It's very easy to slip innocent looking bugs into open source projects with plausible deniability. See e.g. heartbleed or the Debian OpenSSL bug. Note that I am not claiming that these bugs are made by state actors. Just to show that it is easy to slip vulnerabilities in billions of lines of open source code that are used in a Linux desktop system. Heck, the FBI even tried to slip backdoors in OpenBSD which is only a marginal project in terms of high-value targets [1].

If any government has backdoors in macOS outside open source software in macOS, it is probably very limited (the US government if any, but Apple seems to resist most attempts at weakening security).

[1] https://arstechnica.com/information-technology/2010/12/fbi-a...

It’s much easier to put in a backdoor, or actually implement a small monitoring system, in a closed source operating system.

That’s much harder with open source software, not due to technical reasons, but because there is a good chance that eventually it will be discovered by some developer or security researcher. That will cause distrust of the government, and people going to defensive mode, making it much harder for governments to routinely hack into devices.

So, for example, the discovery of the flaw in the Debian random number generator had a huge impact. People who design security systems really pay attention to PRNGs nowadays (to the point that it seems weak PRNGs are no longer a significant concern in the mainstream desktop operating systems, though the issue obviously remains in IoT, virtual machines, HSMs etc).

Hiding the code for malware is common sense. That’s also why governments severely punish leaks these days.

I think your logic stands when thinking about individuals or private organisations.

But when thinking about state actors they almost have unlimited money/resources thus even if adding a backdoor is a bit harder on open source having unlimited money/resources makes it irrelevant.

Where “unlimited” = to the size of the open source organisation that maintains a bit of software.

It's easy to hide backdoors in open source applications.

It's easy to detect backdoors in closed source applications.

People should definitely be using open source for as much as possible, because I want to live in a world that makes it as easy as possible for beginners to understand how their underlying software systems are working. The whole "backdoor" FUD just seems lazy though.

I know I’ll ruffle some feathers on HN, but macOs is fine and probably the best OS for Mac (especially m1) hardware.

No reason to make your life harder unless you’re doing it for your own enjoyment.

Linux for the desktop indeed has hardly progressed the last decade, and it sucks. Sure, gnome is more polished, but it's still a system for tinkerers. It's not user friendly and it's not a complete environment for end-users.