20
OpenBSD
ducks
But x11 is insecure
ducks
I mean... Not wrong
Qubes OS gives him high security with relative ease.
Fedora Silverblue with auto update and Flatseal tightened apps is a nice middle ground.
RHEL minimises supply chain attack risk and provides features like kernel hot patching. He can use free developer subscriptions. Also try SUSE.
Security wise Chromium is a bit better than Firefox. Try to seal it up with SELinux. Red Hat only supports Firefox however.
SecureBlue can be used as a reference, but it's still downstream so personally I'd avoid using it in case of supply chain attacks unless securing Silverblue is too much of a hassle.
Keep in mind that Flatpak sandbox interferes with browser sandboxes.
I think most Linux distros will be fine. As of today desktop marketshare is still small, the governments mostly work within custom business applications. And to this date Linux malware and viruses for the desktop are practically unheard of. The common attacks are against the browsers, not the underlying operating system (so do timely updates and install an adblocker) or we'd expect phishing or phone scams and that's against the human in front of the computer, again not the operating system. That makes me say they're about all alright. Of course they're not all equal. Immutable distros and sandboxing will help here. But the real deal is other countermeasures, like be aware how phishing works and try not to mix online banking and pirating games from shady websites. That belongs on separate user accounts or even installed operating systems. And use password managers, 2 factor authentication and these things. (And don't use Edge, or some browser from some random third-party repository.)
And to this date Linux malware and viruses for the desktop are practically unheard of.
This is dangerously false.
edit: I'm sorry to see I have disturbed a few people here, downvoting the truth without a comment. Explains a lot of contemporary politics, I think.
Can I get some list or a reference to educate myself? As far as I know it still holds true. There's rootkits, a lot of old stuff and exploits of webservers or embedded devices, supply chain attacks towards developers and the one day the Mint ISO file got compromised. But I'm completely unaware of desktop computer malware with high risk or actually spreading?! And the list on Wikipedia seems to confirm what i said...
Okay, let's assume for fun that there's highly developed Linux malware that exclusively infects servers and leaves desktops alone. What exactly is a server? Is it a server as soon as a web server service is running? A DNS service? An SMTP service? Some of these are also included with Linux desktops.
But that's not the point. There's no specific "Linux server malware". There's Linux malware. It targets the Linux kernel (current data point), not any web stuff.
For example it's something that has an Apache webserver installed and that Apache is accessible from outside... So the Apache exploit can do something. Do you have both conditions met on your laptop/desktop computer? I'm pretty sure that won't be the case, and that's the difference here.
Let me repeat my last paragraph, as you seem to have stopped reading after the first question mark:
But that’s not the point. There’s no specific “Linux server malware”. There’s Linux malware.
You're wrong. How would an Apache exploit "hack" your Steam or online banking app? That's just not possible.
Malware uses specific attack vectors and specific vulnerabilities.
Malware uses specific attack vectors and specific vulnerabilities.
The "specific vulnerabilities" are usually in the Linux kernel, quite present on every single Linux system. Please follow the link I posted above. This is not about Apache or any other arbitrary user-facing software.
Thanks for the link. But that's not a vulnerability or malware. It's academic research how to hide malicious syscalls. But it can't infect anyone's computer. And there isn't any vulnerability to let it in.
Thanks for the link. But that’s not a vulnerability or malware.
The RingReaper malware is literally a malware, using known vulnerabilities in the Linux kernel...?!
I'm sorry. Most I can find about "RingReaper" is that single blog post or people who rephrased it into their own articles. There seems to be zero information on how it spreads through the internet? And if anyone contracted RingReaper. And I can't even discern how that'd get on someone's computer unless they install it themselves (which is a form of malware, though not very pronounced on linux due to the distributions and central package repositories). There are no other methods highlighted in the post. And it can't do privilege escalation either, just scan for other vulnerabilities. So is this a thing in reality and how can I find out? It seems like valid research to me, but I can't see how it's more than that.
So is this a thing in reality and how can I find out?
It is one of several things in reality. Linux malware, spreading through the (mostly) same paths as Windows malware does, has been real for quite some time now.
But that in itself doesn’t really threaten my (or OP’s dad’s) computer.
Linux malware threatens Linux computers. It might be important to keep that in mind if you use Linux.
This is dangerously unspecific.
Thank you!
I add this overview article https://www.geeksforgeeks.org/ethical-hacking/what-is-linux-malware/
I don't think OP's dad will host a misconfigured cloud service on their computer or set an insecure password, enable ssh and then also open a port in the router. Most attacks on that list are specific to how internet servers are set up. And well, insecure old embedded devices. And we in fact have those systems targeted regularly. My servers gets bombarded with malicious traffic trying to get in.
I guess the problem is not “the truth” but a claim without sources combined with a short communication style for a really complex matter.
Even the link you posted just reports of one malware instead of the current state or perception of the problem. Like a general threat assessment instead of one incident.
security or ease , pick one
Ubuntu or mint both are fine
If you're picking a distro for someone else I would not recommend a small project distro or something incredibly niche 😅
Any of the big projects should be decent. Fedora, maybe fedora silverblue or whatever their imutable variant is called, opensuse, Mint, Ubuntu, debian. (Personally I don't like some of the choices Ubuntu makes but it may still be a very good option for less technical folks)
Others can tell you which of those have the best security defaults, but to be honest it doesn't sound like you actually have particularly exceptional security needs relative to what any distro will provide. I'd prioritize something stable and user friendly- which, again, your best bet is NOT picking a niche small project or something most people have never heard of
OpenSUSE is big on the security and usability front. None of the services you install activate by themselves. Firewall active by default. The first user doesn't get access to every group under the sun after installation.
And everything can be controlled through GUI tools. But it doesn't throw a fit when you've done something yourself through the CLI.
Opensuse MicroOS variants kalpa and aeon are probably what they are looking for. Stupid easy to set up and, from what I understand, quite secure.
Downside is that it needs workarounds for some things like Steam Flatpak and such, but that is the nature of atomic distros.
Also SELinux by default now instead of AppArmor. It can be a pain but it works. I.e. files dumped into a SAMBA share aren't autoshared unless they have the samba SELinux setting applied, etc
Maybe Secureblue?
That also comes with its own hardened browser based on GrapheneOS's.
And if you don't go with Secureblue and its browser, I'd recommend using a browser Chromium based, probably Brave. I know that's a controversial choice, but in terms of security and ad blocking, it's one of the better options. And disable JIT for V8.
First time hearing about Secureblue. And it sounds great. Though their motivation is quite welcome to see, I’m unsure if it will be actively maintained for a long time. It’s quite young project.
Based upon your wording, I am assuming your father is not particularly tech savvy, if this is the case first and foremost you should be picking a distro that is maintained by a large group of trustworthy developers, this removes the niche distros from the running. Secondly, since he isn't going to want to learn the terminal, you should be picking a distro that installs programs with a GUI package manager or flatpak manager, this removes the likes of arch, gentoo, & open suse tumbleweed. Thirdly, you will want a distro that is based on one you understand well enough to run tech support, I don't know which that is for you, if it is Debian based stick with mint, fedora based go with fedora workstation or fedora KDE, if it is opensuse I don't have any recommendations sorry.
After you select the distro you need to educate your dad that he should only be getting new programs through the package manager, and I would either tell him the inherit insecurity of some flatpaks or remove flathub from your mirror list unless there is something he really needs in which case you need to do your research.
In general security on Linux is a lot more active for IT than it is for Windows, but for the general user if they can get by using a well known distro's repos you shouldn't have any security issues.
If you are overly worried you could add apparmor to the system to isolate the system from programs or pick an immutable distro like bazzite, but in general the immutables are smaller teams which is why I don't prefer them.
Thanks for the thought process it’s really helpful and also reassuring since it’s quite similar to mine and yeah. Secureblue definitely sounds cool but I’m afraid it would not fit my dad’s need. In the end it’s gonna be up to whether I and my father can trust the maintainers or not
Top choice regarding security? Qubes OS. But that's not just a distro.
this is the first time knowing the Qubes OS. and upon researching on wikipedia, it's meant to be used with multiple OSes for different tasks...? wow
It is. the underlying OS is actually a type 1 hypervisor, XEN. better take a look at their official website then wikipedia though.
It essentially is multiple OSes, one host and plethora of separate virtual machines that only communicate what they were designed to communicate.
This way pretty much nothing can get access to userspace.
Secureblue is what I'd use if security was a major concern. Every time I've tried to use a non-Ubuntu distro I've immediately ran into a few technical issues so I stick with Ubuntu.
Generally I think I'm safe as long as I don't install untrusted software, and the distro didn't package untrusted software.
if you're looking for something with the most security, then Qubes. It's heavy, it's slow, but good luck to anyone looking to break into that system.
Bit of a learning curve and a bit to wrap your head around it but I would tell him to think of it like you have access to a bunch of individual computers that don't talk to each other but you control all of them. So he could have a Qube for casual web browsing, could have a Qube for work, and another Qube for financial stuff. all independent of each other. IF something were to happen (malware, trojan, whatever) just simply close that qube window and spin up another.
OpenBSD. No Linux, but much more secure. And yes, there is quite some amount of Linux-specific malware around these days.
True, but my issue with OpenBSD is that the performance is really lacking in terms of desktop smoothness. It feels like sub 60 fps compared the smoothness of Linux and FreeBSD.
I hope it's just a current driver incompatibility and not related to their hardening. Will try again once 7.8 releases.
OpenBSD gets SMP improvements all the time, so yes, chances are that 7.8 will be even snappier. For banking, however, desktop smoothness would not be my primary concern.
There have been some pretty giant performance jumps since the 6-series. I find running -current totally reasonable for a desktop user.
Ah now it makes sense why you are spamming the Ring reaper. Still needs an exploit to get it on your machine. BSD has way less hardware support then Linux.
The precise amount of hardware support of an operating system largely depends on your hardware. For example, iOS runs on iPhones while Linux does not. Does iOS have greater hardware support now?
Frankly, there is not one piece of hardware in my household that wouldn’t work with OpenBSD. I’m sure I could say the same about Linux. And you.
Exploits for Linux systems aren’t exactly sparse, actually.
PureOS might be one, though it's maintained by an American computer corporation.
this post was submitted on 08 Oct 2025
20 points (100.0% liked)
Linux
57274 readers
940 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS