Technology

https://wiki.archlinux.org/title/Security

Applicable to most Linux distros.

First of all there isn't One Linux.

In simple terms for an end user, yes, you are definitely better off with any of the major distros.

Non-commerciality is probably the most important aspect. Or as someone put it a long time ago: "Suddenly I realized that the software is on my side."

the more people continue to ditch windows, the more scammers are going to focus their energy on linux

Sorry, I missed this in my first reply.

It is true.

A few simple rules:

• keep your system up-to-date within the constraints of their repositories
• install only from trusted repositories, i.e. the official ones for your distro. This excludes any package of any app straight from their website.
• same precautions for web browsers as for any other OS. Don't click any old link, don't execute mail attachments, that sort of stuff.
• don't execute arbitrary code esp. from the internet
• don't just sudo if you want to make something work. Despite the famous xkcd, that's not how this works. Least privilege at all times.
• Antivirus software still isn't required

Unless you have some extraordinary usage scenarios, that's it really.

I don't know of any comprehensive source but there are a few basic things you that I do.

1. Ensure sudo is on the system so that root account is not used.
2. Get a secure browser that with add ons to protect against malicious sites (https everywhere, JavaScript blockers, etc...)
3. Download software from trusted repositories and verify with GPG keys or hashes. Be wary on installing anything using a shell script with super user access.
4. Use keys instead of passwords for ssh if you are going to use ssh.
5. Password tools like Vaultwarden and KeePass can help secure passwords.
6. You can encrypt your hard drive with LUKS before you install Linux with many distros.
7. Flatpak (Docker as well) can allow you to run applications with limited access to your system much like phone apps on Android. This can be more secure but comes with larger app sizes and limits what you can do with the app sometimes (e.g. browsers not being able to upload files because they don't have full filesystem access)
8. If you want a firewall on your workstation (not needed much anymore with hardware firewalls from routers), UFW makes it easy
9. If you want to check for viruses use ClamAV (ClamTK for a GUI app).

I've used Linux for 15+ years.

Install from the repositories, if it isn't in your "app store" or installed using apt or yum or whatever your distro package manager is, don't bother with it until you're more familiar with Linux.

Your system is 99%+ of the time going to be secure as long as you don't install something sketch. You need to install it, it won't just happen on it's own, things can be hidden behind copy paste instructions so be sure you have a good idea of what each step does if you're doing that (I've never come across this in the wild, FYI). The other small percentage is a bug or something in packages (see the xz debacle) which you have little control over. The best thing you can do is just keep packages up to date.

Please nobody wheel out the Swiss cheese analogy or I'll shit myself.

Then you want them to advertise NIST PQ standards

... Which is also not necessary for single user password databases anyway

Try to do some research like you would do with closed source tools. See if they have a website and if it links to the GitHub you encountered. Also see if there are subreddits or forums and see what they link to.

In the case of this "Pro" version of KeePass; a simple search would have shown that there is no Pro version.

Checkered checkmark

Just tried a search for Magisk and uBlock indeed does a great job at blocking all the scam websites.

This reminds me of the new vector for malware that targets "vibe coders". LLMs tend to hallucinate libraries that don't exist. Like, it'll tell you to add, install, and use jjj_image_proc or whatever. The vibe coder will then get an error like "that library doesn't exist" and "can't call jjj_image_proc.process()`.

But you, a malicious user, could go and create a library named jjj_image_proc and give it a function named process. Vibe coders will then pull down and run your arbitrary code, and that's kind of game over for them.

You'd just need to find some commonly hallucinated library names

As a Typescript developer, npm is a damn mess. I ain’t got a clue how to handle these dependencies.