You have so many more practical options for even amateur security auditing on Linux. You can trivially spin up a temporary OS/chroot/container and run your specimen inside it, or run it under strace and log every system call, or statically sift through an executable for strings like IP addresses in an instant using basic tools. Bash install scripts can simply be grepped. It's an environment that gives the user control by default, and as such it's that much harder for executables to gain the upper hand.

Obviously you don't do that for every binary you run, but you have options if there's something you're a bit suspicious of.

All of those options have Windows analogues though. Windows users can spin a VM, run procmon, and even have access to text editors.

Indeed. "Run a program or browser extension in Sandbox mode" is a great deal easier in Windows than the equivalent in Linux.

If people were doing their due diligence on every binary they execute, malware beyond highly targeted zero-days would be non existent.

On the other hand it seems entirely possible to use only apt-get install and be happy on linux.

Nowadays, you can also mostly life with just choco install on Windows. Not as well vetted as Debian packages, but a lot better than google.

But that only helps power users. On linux learning these things is simply a necessity because installing things outside your package manager is even less user friendly.

This is the essence of most of the rhetoric I'm seeing in this thread: Linux is more secure because its users are more technical.

I thought choco software is not vetted but managed by individuals, like the AUR in arch.

I dont know, i think the graphical frontends to package managers on linux are much easier than downloading and installing an exe on windows

I wonder how many preinst/postinst scripts are being read by apt users prior to install/upgrade? These run as root, making them a bit worse than the typical curl|bash after all.

Yeah, its so naive that its not even worth commenting.

If the alternative is not even sources but just a black box binary, then its at least better to be able to inspect the sources.

I agree. But I think we shouldn't equate the fact that we-have-the-technical ability-to-do-this with we-have-the-bandwidth-and-the-skills-required-to-do-this.

The discussion was a comparison against the security culture in Windows. Source availability is a sort of bare minimum at least, obviously by itself thats not enough one wants the source to have been crosschecked by lots of eyes.

My personal opinion regarding security I would say is easy ability to apply sandboxing at various levels on the user side for software we trust less. (By user side I mean not depending on the developer to package the app a certain way etc. A virtual machine or a chroot jail etc are examples of what I meant by this).

My point isn't that you should review the scripts you download to install as much as it's that you should avoid using those if you actually care about security. They are, in every single case that I've ever seen that they're not actually nefarious, merely convenience methods that automate a bunch of manual steps that are outlined in instructions which you can also follow.

And that's in the cases where they (or trusted third parties) aren't actually packaging it already for more normal installation in the OS you're on.

So, I'm not being idealistic and saying "read the code of everything you run", I'm saying "realize that running random scripts is equivalent to running random executables in a lot of cases, so maybe don't do that no matter the OS, as it's not an OS problem and one OS won't really protect you regardless of whether it's Linux or Windows or Mac OS", and thus it's not really a Linux problem at all. As an example, I'll leave you with this[1], which I find fairly relevant since it has the powershell equivalent if curl piping to bash.

1: https://deno.land/[email protected]/getting_started/installatio...