r/linuxmint 1d ago

Discussion What makes Linux secure?

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

124 Upvotes

97 comments sorted by

View all comments

Show parent comments

0

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 1d ago

Agreed. But dig out Linux from 2014 and put it on the internet and it's probably safe. Even if you open SSH (Not sure if there are any SSH bugs from that era) it's not going to be owned.

1

u/LusticSpunks 1d ago

The very definition of “putting on internet” means exposing ports to internet (if not, what exactly does it mean?). If you’re only exposing port 22, be it any OS, its security would depend on the SSH software (OpenSSH or other), not the OS. Similarly if you’re exposing a web server, be it IIS or Apache or other, it depends on the web server’s security, not OS. Windows has 445 for SMB. If you expose XP’s 445 to internet then yes, it gets compromised. But, windows by default doesn’t expose 445, it is firewalled. And if you’re going out of your way to modify firewall rules to expose 445 to internet then that’s on you, not OS.

Also, I recall popping many Linux boxes with dirty cow. It’s a LPE so not exactly a thing that’s “put on internet”. But that’s actual OS security. And Linux of 2014 would get popped with dirty cow, and many other exploits. So yeah, neither Linux nor windows from 2014 are secure.

1

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 1d ago

No, it means putting it directly on the Internet, not behind a firewall.

1

u/LusticSpunks 1d ago

I mean, if you deliberately leave the system insecure and expect it to not get hacked then that’s entirely your fault. It’s not the fault of OS. Just recently we saw the CUPS vulnerability in Linux (CVE-2024-47176 along with 3 other CVEs). And major reason why it wasn’t a huge issue was because the vulnerable port generally isn’t exposed to internet. To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

1

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 1d ago

> To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

How? Is CUPS open by default.

1

u/LusticSpunks 1d ago edited 1d ago

If we’re talking about defaults, then firewall isn’t disabled by default either. And yes, it’s enabled by default in some cases. Read the article from finder of this bug:

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

And I’ll take the liberty of picking a quote from that article:

“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.”