Linux Antimalware/Antivirus debate - Page 1
Forum section: electronics / general

author: Ampera
author_rank: Super Contributor
timestamp: October 19, 2016, 12:26:09 pm
content: I am aware that there are other posts out there, but since this sorta stuff can change with the wind, I thought I could ask again real quick.I am currently taking a vacation from Windows 7 and taking up holiday in my Linux Mint partition which is faster, nicer, and developed by reasonable people instead of ravenous baboons.Edit: Yea, didn't mean for a simple question to turn into a pissing war. One could get away without an AV on linux just fine, I just wanted one for the sake of having one, viruses exist, and nevermind their rarity I want something to use if I get one, especially for the amount of tinkering I plan to do.Alright, the intent of this post has ultimately changed and it is now a debate so I thought I should change the title, maybe we can get more people in.Just don't get nasty.

author: Karel
author_rank: Super Contributor
timestamp: October 19, 2016, 01:48:50 pm
content: Despite I'm a long term Linux user, I can't help you with that.I never felt the need to have one. Never got suddenly extra "toolbars" or "search windows" in Firefox,my startpage was never suddenly changed, never got annoying popup screens or strange redirects to pr0n sites like I have seen on windows pc's (which were running updated av!).That being sad, the value of av is much overrated. There's no av that detects all active viruses or mallware that runs in the wild.Every day, new mallware is released which is not recognised by av despite heuristic analysis. It takes at least a couple of days before the new mallware has been reported,analyzed, added to the av-list and updated to the clients. In the mean time many pc's are already infected.One could argue that it's better to have just three pieces of mallware installed on your pc instead of hundred, but in the end I don't think it makes much difference...A quote:Rootkit detection is difficult because a rootkit may be able to subvert thesoftware that is intended to find it. Detection methods include using analternative and trusted operating system, behavioral-based methods, signaturescanning, difference scanning, and memory dump analysis. Removal can becomplicated or practically impossible, especially in cases where the rootkitresides in the kernel; reinstallation of the operating system may be the onlyavailable solution to the problem.Operation "Red October" was able to stay under the radar for five years:https://securelist.com/blog/incidents/57647/the-red-october-campaign/Antivirus software is now so ineffective at detecting new malware threatsmost enterprises are probably wasting their money buying it, an analysisby security firm Imperva has concluded.http://www.cio.com/article/2390136/antivirus-software/antivirus-software-a-waste-of-money-for-businesses--report-suggests.html

author: ataradov
author_rank: Super Contributor
timestamp: October 19, 2016, 04:51:09 pm
content: Why do you even need an AV for Linux?

author: MatthewEveritt
author_rank: Unknown
timestamp: October 19, 2016, 05:04:46 pm
content: If have clamscan installed. It's not necessarily the best, but it's generally in the repos for most distros and of course being able to scan the windows partition from Linux has its advantages. For single files in not sure about I also recommendvirustotal.com.

author: michelinux
author_rank: Contributor
timestamp: October 19, 2016, 05:11:16 pm
content: I use (in Slackware and OpenSUSE) ClamAV:http://www.clamav.net/.For your distribution (Linux Mint) use:Code:sudo apt-get install clamav clamav-daemon clamav-freshclamUse:Code:sudo apt-get install clamtkto install clamav GTK frontend

author: Halcyon
author_rank: Unknown
timestamp: October 20, 2016, 12:29:50 am
content: Quote from: ataradov on October 19, 2016, 04:51:09 pmSorry, this is one mentality which I just don't agree with, but SO many Linux users believe it. It's almost as silly as saying "I don't need antivirus for my Android handset or my Apple computer". It's naïve.Sure, there are only a handful of viruses and malware which can "infect" a machine running Linux (at the moment), that isn't in dispute, but they do exist. Furthermore, you can still have infected files or executables on your machine that can affect other users (running Windows, OSX etc...). Yes the risk is low, but why take it? Why just trust that nothing will happen to you?It takes next to no resources to run a basic virus scanner on your machine and many of them are free. As someone who has worked in the industry for many years, my suggestion is anything that is connected to the internet should have some sort of basic protection (for devices which I can't run AV on, they sit behind a firewall with very strict rules, for example my TV or my Sonos speakers).It's much the same reason I pay for comprehensive car insurance, it's not because I'm a risky driver, it's because of factors that I can't control (like other people).

author: ataradov
author_rank: Super Contributor
timestamp: October 20, 2016, 01:16:50 am
content: Quote from: Halcyon on October 20, 2016, 12:29:50 amI don't believe in anything, I know what I'm doing. To be fair, I never run AV on Windows either, and I had no problems whatsoever. Just don't run random garbage from the Internet.Quote from: Halcyon on October 20, 2016, 12:29:50 amShow me a single virus for Android.Quote from: Halcyon on October 20, 2016, 12:29:50 amAs proof of concepts with a whole lot of setup required.

author: Halcyon
author_rank: Unknown
timestamp: October 20, 2016, 02:36:07 am
content: Argh. I can see this thread will derail into a pissing contest very quickly, so I'm not going to address each and every point.My point is, viruses, trojans, malicious software are all out there for Linux, Android, Windows, OSX, OS/2 Warp... protecting yourself isn't a bad thing even if you're an IT expert who never clicks on stupid things. Even some relatively legitimate applications can exhibit suspicious behaviour that you'll probably want to know about.If you want to run the risk and block your ears because you know better, more power to you! No one is going to stop you. But I certainly think the OP is being smart about it and rather question his movies, why not try to help him out and provide some suggestions.

author: linux-works
author_rank: Super Contributor
timestamp: October 20, 2016, 02:57:01 am
content: you can get break-ins on linux if you don't set your system up properly.but as for 'infected binaries' its rare as hen's teeth and usually an anti-vir won't help; if you have an infected binary that you pulled down from a distro or other source, it came from them and was not due to 'browsing habits', which is much more common in windows.the web is the most common attack vector and to protect yourself, run firefox and lots of plugins (I use noscript, adblock and others that do things like that). I only enable javascript on the FEW sites I trust. generally its disabled unless I know its safe to turn on.you also should be browsing as a non-root user. to be even safer, create a 2nd user account and use that one for JUST browsing. no mail, no local folders or files, etc. the worst they could do is drop files into this 'empty' account and it would not affect anyone else or the system, as a whole.mostly, though, keeping your linux box updated is ALL you need. antvir on linux is a total waste and only the vendors will try to convince you that its needed. I've been a linux sysadmin since 1995 or so and I've NEVER run into any admin (corp or hobby) who runs an antivir on linux. its just not done and even at big companies (like intel) don't run antivir on linux. on windows, OH BOY do they! but on linux, no. never saw it done in any company I've been at (and I've been at many unix-based companies including ones that MAKE or used to make unix).note, I'm not talking about scanning windows drives from linux, but just talking about antvir for linux. I assume that's what you were asking (?)

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 06:38:46 am
content: Quote from: Halcyon on October 20, 2016, 02:36:07 amThe point is, it's useless, for the reasons I wrote above.If you want a secure pc, don't connect it to a network. If you need internet access, boot from a Linux cd.

author: Halcyon
author_rank: Unknown
timestamp: October 20, 2016, 08:35:40 am
content: Quote from: Karel on October 20, 2016, 06:38:46 am... and if you want a car that never crashes, don't drive it.Sure, if you're 1% of users out there. For the rest of us who do connect it to a network and do need internet access and don't want to boot from a Live CD each time... then there are common sense steps you can take to protect yourself.The OP sounds like he is using his machine as a normal desktop machine connected to a LAN and the Internet like almost everyone else out there. Taking rudimentary steps in security is far from useless.

author: setq
author_rank: Frequent Contributor
timestamp: October 20, 2016, 09:10:31 am
content: I haven't seen a Mac or a Linux desktop with AV software ever. They only use ClamAV etc etc on the mail gateway so that you don't end up accidentally forwarding a windows virus to someone else on windows.The infection vectors are poor network configuration, unnecessarily exposed services and users running shit blindly from the web (curl/sh crap does my head in). Each of those isn't by default an issue on a standard desktop machine and is usually constrained to a single user account if it does go bang.Meh.Don't use a shitty distribution with crappy security policy like mint, backup incrementally, keep it updated and don't turn on random services and you'll be fine.(Linux admin for ref. Use CentOS, Debian or Ubuntu LTS if you want any security guarantees)

author: John Coloccia
author_rank: Super Contributor
timestamp: October 20, 2016, 09:54:15 am
content: I didn't know anyone even made a Linux anti-virus suite.Quote from: setq on October 20, 2016, 09:10:31 amWhat's the crappy security policy on mint?

author: StuUK
author_rank: Frequent Contributor
timestamp: October 20, 2016, 10:17:44 am
content: https://sites.google.com/site/easylinuxtipsproject/securityIs worth a read....

author: setq
author_rank: Frequent Contributor
timestamp: October 20, 2016, 10:19:46 am
content: Quote from: John Coloccia on October 20, 2016, 09:54:15 amNo security advisory listing, updates from Debian/Ubuntu upstream are blacklisted regularly as it breaks their own tools and this will leave your machine wide open, their web site was breached badly and there is no public policy on how their infrastructure is managed. It's also run by a personality cult. I wouldn't go near it if I'm honest.

author: JPortici
author_rank: Super Contributor
timestamp: October 20, 2016, 10:34:06 am
content: Quote from: ataradov on October 20, 2016, 01:16:50 amNot really a virus as usually this is in accordance with the service provider..Reminiscent of the good ol days of the dialer bastards, there are self clicking ads that will open the browser in background and access subscription based services that are activated the instant you enter the website and that are not so easy to disable.If you don't want to be scammed you can pay the provider basically the same amount of money.. or you ask to block all such services but that comes with drawbacks like not being able to access cercain websites or do things like home banking. An antivirus wouldn't stop all of that. An ad blocker would.. but you know, google android...Still, i agree with you that for most people antiviruses are an useless waste of resources. for most people the best antivirus is common sense

author: rob77
author_rank: Super Contributor
timestamp: October 20, 2016, 11:08:36 am
content: the only valid case when you should run AV on linux is when you're providing a network share to windows machines. the AV is usefull in that case because it will detect a virus placed onto the share by one of the windows client machines and you'll not allow to spread that windows virus through that network share to other windows machines.there is no such thing like successful linux virus ! there is some malware targeted to incompetent users, but there is not a single successful linux virus.

author: mac.6
author_rank: Regular Contributor
timestamp: October 20, 2016, 12:24:02 pm
content: Quote from: michelinux on October 19, 2016, 05:11:16 pmHave you been able to catch anything with ClamAV?I haven't in the last 10y of use. Most windows rootkit pass through it without being detected.In fact my anti-spam filering is more effective...

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 01:45:05 pm
content: Quote from: Halcyon on October 20, 2016, 08:35:40 amYour comparison is wrong. Try this:You have more chance to catch malware with an updated windows pc with an update av, than with an updated Linux system without av.There's really no point to use av on Linux.Hypothetically speaking, if much more people should use Linux on the desktop, it would be another situation.But we all know that this is not gonna happen within the next ten years or so...

author: hans
author_rank: Super Contributor
timestamp: October 20, 2016, 02:51:33 pm
content: Quote from: setq on October 20, 2016, 10:19:46 am+1Exactly why I'm back at Ubuntu instead of Mint. Their downright infected ISO's didn't instill a lot of confidence.In terms of most viruses the user is the most infectious of all. All viruses I got ages ago (like 12+ years) were due to my own fault.Don't run random crap from the internet.Don't type any command into the command line willy nilly, especially when sudo is used.Don't insert 'found' USB drive into your machine.Check what services you forward in your firewall.Disable leaky plugins like Java and Flash (because malware could install inside a browser).Disable ads.I haven't considered the use of an AV on Linux, because I can do without in Windows, apparently, for years. At least, in those years AVG/Avira never detected anything.. other than many false positives (like Steam games) and AV nags.My opinion may change over time if Linux adoption becomes larger, but for now I just stick to deb's from the apt repositories and keep any other installations to an absolute minimum (also for the maintenance convenience).However I believe Sophos do make AV for Linux:https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx

author: rrinker
author_rank: Super Contributor
timestamp: October 20, 2016, 05:54:12 pm
content: Disclaimer: I do have a Linux machine in my network, it runs UbuntuBut really, this - well, I don't know what to call it other than 'crap' is why Linux is still niche and not mainstream. It wasn't all that long ago I was reading how I was pretty much stupid for using Ubuntu, they have privacy issues and their distro is hugely bloated, and I should use Mint instead. Now its - don't touch Mint, their out of the box security is a mess and they even distributed infected ISOs.Your average computer user who doesn't know the details of ANY popular OS is just going to look at this stuff and stick with Windows if they currently have a Windows machine, or MacOS if they currently have a Mac. Only if you are somewhat knowledgeable about Linux would you even begin to be able to tell that Mint has security issues.There's a general consensus that Linux is Pretty Good. But then when you start talking about which specific flavor, it's as bad as a religious discussion. How many people just wait on the sidelines to avoid getting involved, or throw up their hands in frustration when they ask what they should use and 10 people respond with 10 different answers? Choice is a wonderful thing, but it's possible to have too much choice, leading to analysis paralysis, especially when making a choice had far reaching effects on software compatibility. Ubuntu has always been the closest thing to a smooth and easy experience for me, back when I first discovered it I had tried about 4 other distros, each with its own problems. Ubuntu's trial mode CD booted right up and worked perfectly on my machine, no fiddling around. None of the others I tried did as well, and so I've used Ubuntu when I wanted a Linux machine ever since. That was far from my first Linux experience - I believe the first one I used was 0.89a right after I got my first 386 machine - a pack of 3.5" floppies from which I had to compile the kernel for my machine. In those days - no way it was suitable for typical computer users, but it was interesting getting it to load and then getting an x11 system running on top.

author: Marco
author_rank: Super Contributor
timestamp: October 20, 2016, 06:02:48 pm
content: Quote from: blueskull on October 20, 2016, 01:51:20 amResearchers claimed to havecracked ALSR recently.If true that returns us to the reality before ALSR, millions of LOCs with thousands of buffer overflows running at root waiting to be found and exploited. Local root exploits back to dime a dozen status.PS.seemsI was a bit too trusting of their claims. Remains to be seen.

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 06:06:33 pm
content: Quote from: Marco on October 20, 2016, 06:02:48 pmAverage opensource software (including the Linux kernel) contains less errors (including buffer overflows) than closedsource software.

author: Marco
author_rank: Super Contributor
timestamp: October 20, 2016, 06:09:51 pm
content: Quote from: Karel on October 20, 2016, 06:06:33 pmHalf a ****ton instead of a ****ton is still a lot.

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 06:12:16 pm
content: Quote from: Marco on October 20, 2016, 06:09:51 pmSo? What's your point? Don't use a computer at all?

author: Marco
author_rank: Super Contributor
timestamp: October 20, 2016, 06:42:08 pm
content: No, be realistic about risks. As a society we are completely unrealistic about computer risks, we have allowed an industry to grow up which gets away with taking completely unreasonable risks.Computers on company intranets shouldn't be browsing the bloody web or working on foreign documents much more complex than ASCI. Data streams need to go into the intranet of course, but most data is much easier to sanitize than HTML and document formats. At the very least that kind of work should be done in separate virtual environments, although host graphic drivers are still a huge attack surface (lots of LOCs of C code easily reached, C being one of the root causes of the current mess we're in).The Internet is in a similar situation, with ISPs being allowed to spawn traffic while they don't even do basic ingress and egress filtering.We have to live with the damages, while these clowns just keep on keeping on with business as usual and almost everyone pretending the emperor has clothes.

author: Halcyon
author_rank: Unknown
timestamp: October 20, 2016, 06:51:05 pm
content: Quote from: Karel on October 20, 2016, 01:45:05 pmI completely disagree.No one is disputing that you have more of a chance of catching something with Windows v Linux. No one ever said that. But that doesn't mean that you shouldn't protect yourself on Linux. There is still a chance and sure, that might be due to user error.But what you do on your machine is your business. If you feel confident that you will never make a mistake, accidentally run something dodgy and you rely on updates to keep you secure, then good luck to you. What works for you doesn't necessarily work for everyone else and it doesn't make them 'wrong' either.

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 07:00:44 pm
content: Quote from: Marco on October 20, 2016, 06:42:08 pmI am. The risk that malware infects an updated Linux computer without av is lower than with an updated windows pc with updated av.Quote from: Marco on October 20, 2016, 06:42:08 pmWithout C, there shouldn't be computers and internet in the first place...Apart from assembly, there's no way to write efficient operating systems other than in C.Ofcourse, people who don't have the brains to understand the concept of pointers to pointers(or maybe they do have the brains but they are just lazy and don't want to use them),should stay away from C.

author: Karel
author_rank: Super Contributor
timestamp: October 20, 2016, 07:10:03 pm
content: Quote from: Halcyon on October 20, 2016, 06:51:05 pmHow should I protect? With av? That's pointless. Let's say that av catches 95% of malware.With the amount of malware going around, there's still something slipping through.Do you have a threshold where you say "to many infections, I don't use this pc for online banking"?It makes no difference if your pc is infected with 100 or just 1 piece of malware. In both cases you shouldn't trust it.So, why people with windows pc's and av that can't catch all malware are doing ok when they do their online bankingbut people using Linux without av are doing "wrong" while in reality their chance to catch malware is much lower?

author: Zero999
author_rank: Super Contributor
timestamp: October 20, 2016, 07:39:12 pm
content: Quote from: Halcyon on October 20, 2016, 06:51:05 pmAll right. Suppose you're right: AV is required for desktop Linux. Can you suggest some decent AV software for Linux?

author: Marco
author_rank: Super Contributor
timestamp: October 20, 2016, 07:51:49 pm
content: Quote from: Karel on October 20, 2016, 07:00:44 pmThere is no need, if the kernel and drivers are kept small enough you can throw sufficient code review and mathematical equivalence provers at them (ie. seL4). Then program on top of that with a non retarded language chosen for it's ability to prevent basic errors by design, rather than for it's popularity with lazy overconfident programmers (or brilliant programmers too obstinate to change their ways even though they are perpetuating a situation most other programmers can not help cause a mess in).This development is coming along now, but a couple decades later than I'd have preferred to see it.

author: Halcyon
author_rank: Unknown
timestamp: October 20, 2016, 08:10:32 pm
content: Quote from: Hero999 on October 20, 2016, 07:39:12 pmI personally use F-PROT on my Windows machines. It's light weight and doesn't annoy the crap out of you. Don't expect a comprehensive security suite though, this is purely Anti-virus and Anti-malware.They do a Linux version as well:http://www.f-prot.com/download/home_user/download_fplinux.htmlwhich also runs on AIX, BSD and Solaris. I haven't used it though.

author: michelinux
author_rank: Contributor
timestamp: October 20, 2016, 09:02:55 pm
content: Quote from: mac.6 on October 20, 2016, 12:24:02 pmRootkit' are different form viruses.I use ClamAV mainly for my "Windows mail contact".Against root-kit inuser-spaceyou can use (only monitoring)AIDE(http://aide.sourceforge.net/) orRootKit Hunter(http://rkhunter.sourceforge.net/) etc.Against root-kit inkernel space, like Adore-NG (https://github.com/trimpsyw/adore-ng, only educational use) o suckIT (aliasrootkit LKM), you must disableLoadable Kernel Moduleoption in the kernel configuration (Enable loadable module support)

author: Mr Smiley
author_rank: Frequent Contributor
timestamp: October 20, 2016, 10:10:58 pm
content: I have always found, that all windows users have by default been given an administrators account. If you change them to a standard user account, they jump up and down because they can't install what they want or do simple things like change the time, things Microsoft decided only an administrator can do. So everybody wants an admin account.Someone using windows on a daily basis with admin access rights can cause utter destruction to their system with a single click of the mouse button. Anything and everything can be installed/deleted without them even knowingOn a Linux or Unix machine, everybody is painted with the same brush - a standard user account by default - you can change your own data; documents/photos/mp3s ect but you can't touch the system or other users data. Only Root can do that, and on a lot of distributions a full Root account is not allowed as a desktop user, if you do manage to set one up, a lot of programs will not run as Root under X. And Sudo is not as powerful as Root but when you use Sudo it's a one shot execution meaning it will do what Root can do, when it's finished it drops you back to standard user rights.Linux/Unix was built from networking up - Windows added networking on the end as a last minute botch and it's been a botch ever since.

author: Marco
author_rank: Super Contributor
timestamp: October 20, 2016, 10:21:54 pm
content: Quote from: Mr Smiley on October 20, 2016, 10:10:58 pmOn the other hand, I have all the rights I need to install a program to some obscure user directory which acts like my terminal program which records my sudo password, and to change all the references to it on my desktop. Exploits are nice for privilege escalation, but with the average user completely unnecessary.Me included, I used to keep a virtual terminal logged into root for all my root needs. On my current install I didn't bother to configure a root account and got lazy and now I'm using sudo in a x terminal ... sudo vs root sure improved my security :/ Laziness is the bane of security and we're all lazy. That's why companies need to hire masochists to run IT departments, to enjoy the whipping necessary for everyone to do the right thing.

author: Mr Smiley
author_rank: Frequent Contributor
timestamp: October 20, 2016, 10:47:14 pm
content: "That's why companies need to hire masochists to run IT departments, to enjoy the whipping necessary for everyone to do the right thing."That's one of the jobs I had. I would give them machines with standard user rights, and my boss would go around changing them to Admin rights because he wanted a quiet life, guess who got the bollocking and had to clean up the mess when they messed upUnfortunately this leads down a dark path. All IT people who have to provide support to hundreds of lemmings come to HATE WITH A VENGEANCE anything to do with computers.

author: setq
author_rank: Frequent Contributor
timestamp: October 21, 2016, 05:43:49 am
content: That is why I'm here

author: Srbel
author_rank: Frequent Contributor
timestamp: October 21, 2016, 07:05:36 am
content: You dont need AV for Linux itself, but you may want to have an AV checker in order not to infect a Windows machine, if you are transfering some files from Linux to Windows one.I use ClamAV for that. On Ubuntu 12.04.5. It is an open-source AV.P.S. As I remember, to get a GUI for ClamAV, you also need to install ClamTK:Code:sudo apt-get install clamtk

author: R005T3r
author_rank: Frequent Contributor
timestamp: October 21, 2016, 12:26:11 pm
content: Quote from: blueskull on October 20, 2016, 01:51:20 amSeriously? it's too good to be true...

author: bingo600
author_rank: Super Contributor
timestamp: October 22, 2016, 05:12:44 pm
content: Quote from: blueskull on October 20, 2016, 01:51:20 amAhemmm ... Cough ... Coughhttp://thehackernews.com/2016/10/linux-kernel-exploit.htmlEven though i have used linux since 97' - Nothing is bulletproof/Bingo

author: Marco
author_rank: Super Contributor
timestamp: October 22, 2016, 05:32:00 pm
content: As I said before, if you use sudo in an x terminal (which I do) it allows privilege escalation completely without exploit.

author: madires
author_rank: Super Contributor
timestamp: October 22, 2016, 05:55:33 pm
content: Instead of looking for a antivirus software I'd recommend to check out SELinux (https://selinuxproject.org/page/Main_Page).

author: Ampera
author_rank: Super Contributor
timestamp: October 22, 2016, 08:10:41 pm
content: Holy shit, this is practically a flame war. I should have known this would happen.Look guys, the reason I want one is because it's just something I feel safe having. I am perfectly aware of the decent security of Linux in that nothing can do anything without SU permissions, but that is like saying you can run Windows 7 without an antivirus as long as you don't click a bad link.I just wanted a program I could have just in case as it's normally not a big deal to have an antivirus program installed, and if I was to use Linux of any sort I wanted to have some form of AV on it.Thanks for the suggestions, I currently am experimenting with Linux as I plan to drop Windows after Win7 dies (Unless they fix every single problem with windows 10 or any new operating systems as I see wrong)Windows 7 was the last usable version, and I use it because of it's great support for old and modern software, but Linux is my operating system of choice if it did everything windows could.Again, thanks for the suggestions, sorry I made a pissing war, and I would kindly ask everybody please consider this thread case closed, a lock would be nice if a mod walks by.

author: strangersound
author_rank: Regular Contributor
timestamp: October 22, 2016, 08:32:55 pm
content: Quote from: TwoOfFive on October 22, 2016, 08:10:41 pmNo need to apologize, it's just one of those hot subjects people love to talk about. It's also part of the fun of forums. NO thread ever stays on course, it's just the nature of the beast. It's why I love forums. They produce organic conversations.I'm thinking you might be best looking for something that's browser based, rather than OS based. That's the primary infection vector. Like others suggested, adblocking, noscript, and things like that will prevent most risk...in addition to common sense.

author: Ampera
author_rank: Super Contributor
timestamp: October 22, 2016, 08:44:58 pm
content: Quote from: strangersound on October 22, 2016, 08:32:55 pmI refuse to use noscript for my own sanity. I've seen it and using it is a constant case of allowing scripts for every single website you go to. It just doesn't do anything for me because if I were to go to a website, harmful or not, it's going to be broken so I have to allow the scripts anyways, just leading to a load of stuff.My want is more of a removal tool like malwarebytes, but for linux, and prefferably free. I have yet to try out any suggestions here, but thanks for helping.

author: strangersound
author_rank: Regular Contributor
timestamp: October 22, 2016, 09:48:54 pm
content: Quote from: TwoOfFive on October 22, 2016, 08:44:58 pmI feel your pain about about Noscript. That used to be my favorite browser plugin, but like you said, it got to the point where sites were so heavily built on javascript, it became a real hassle to use it. I miss the old days when things were basically html/css with the occasional script. Now they use javascript in what I would consider to be an abusive amount. Page weights and browser load just keep getting worse. Combine that with bloated browsers and we get what we have now...where a machine with 2gigs of ram can become unstable with just a few tabs open. I remember when I could have 47 tabs open and Chrome wouldn't even flinch. Facebook is especially bad at eating up ram. I guess it's the usual case of form over function...design taking precedent over content.I did some searching around and found numerous other threads in other forums that seemed to produce the same scenario as this thread. From what I can gather, the general consensus is you really don't need an AV for a Linux system. But the main suggestions I found echoed the suggestion for ClamAV.I also found some relevant points and another suggestion here:https://blogs.sophos.com/2015/03/26/dont-believe-these-four-myths-about-linux-security/

author: Ampera
author_rank: Super Contributor
timestamp: October 22, 2016, 10:01:24 pm
content: Yea. I have a 16GB memory machine with 16GB of swap (Windows 7, so half of that will be lost who knows where) and chrome dies out on me after a hundred or so tabs.There is also the other side of Javascript and all that extra guff making extremely impressive websites that perform almost on the scale of a desktop app, doing things impossible about a decade ago (unless you want to push yourself into the suicide spiral that is Flash). The bloated browsers thing is true as well. As tech moves forward, the overhead of these browsers increase like crazy. Chrome by far is the nicest (except for the fact that you can't do tab scrolling as default, a thing I have yet to understand).Another bone I would love to pick at is the general UI of newer windows and windows programs in general. I get minimalism sells, but it looks like something you could make with the MDA character set, not a bleeding edge operating system.

author: rdl
author_rank: Super Contributor
timestamp: October 22, 2016, 10:42:04 pm
content: There are many options available with Noscript. There is one to allow temporarily the top level domain. So if you go for example to somedomain.com, all the somedomain.com scripts will work, but nothing that comes from elsewhere. To me this is how it should be by default. Who came up the stupid idea that your browser should run and fetch stuff from all over the internet without your permission? You will run into a few places that use multiple domains, which causes a bit more trouble. Anyway, I have the main twenty or so places I visit frequently white listed, so no problems there.Ghostery is another add on I consider almost mandatory, along with a comprehensive Hosts file. And no Adobe Flash installed.

author: madires
author_rank: Super Contributor
timestamp: October 23, 2016, 12:05:54 pm
content: Quote from: strangersound on October 22, 2016, 09:48:54 pmThis correlation between the average speed of internet access, computing power and bloated web pages is nothing new. But it's not all bad. This forum wouldn't be possible without it.

author: rob77
author_rank: Super Contributor
timestamp: October 23, 2016, 12:35:12 pm
content: Quote from: strangersound on October 22, 2016, 09:48:54 pmthose aren't the old daysi miss the old days when the web didn't exist yet or at least wasn't prevalent and we used gopher instead

author: SeanB
author_rank: Super Contributor
timestamp: October 23, 2016, 01:03:26 pm
content: Noscript, Requestpolicy, ghostery and Ublock origin is amongst what I use. works well to get rid of those annoying flashing ads, and as a bonus you definitely have a better web experience.Whining about them breaking things is like moaning that you got mugged walking in a dark alleyway, flashing a bundle that could choke a horse, and expecting things to all go your way. The difference on the internet from a safe place to the alleyway is not even a click away, so having a modicum of protection, and not relying on the muggers having a change of heart is something to aim for.

author: 2N3055
author_rank: Super Contributor
timestamp: October 23, 2016, 01:15:47 pm
content: If you don't mind, I would like to clear up few things that came up here..First, we call it malware. Virus is just one of technologies, and lately, not even the worst one..Most of modern malware uses dozens of different technologies, so one malware will use combination of viruses, trojans, rootkits and such.. They became modular software..And here comes fun part.. Newest ones SPAN ACROSS hardware and/or OS platforms.... You get your PC infected, it spreads over your home network to your Android phones MacBook etc..It is not so widespread yet, but give it time...There is NO SAFE platform.. Malware exists on ALL UNIX variants, all Windows variants.... All Unix variants include Linuxes, Android and Mac OS X.And yes, there is more malware for windows platform, but that is because there is ss much more windows based PCs that others.. If you normalize numbers, there is much more infected PC's running linux than their users would like to believe.. Malware makers go after the market, if Linux gains more market share, there will be more malware made for it...Also as some noted, as in medicine, hygiene is is important.. Do not install or run anything funky, do not open funky emails, do not browse funky sites... That help most of the time.. And is important.Last year there was an malware attack, that pretended to be email from you ISP, with a invoice in it. They knew by you IP address what is your provider, and every person got email that looked like a real thing. It had PDF in it, with logo and all of it.It used zero day exploit, that went straight through all defences, and installed Cryptolocker....There was NO defense against it. We live in a world of zero day exploits, that use previously unknown problems...And funny that, in last year, more were found on Linux than Windows..Because of wrong attitude that somehow Linux is holly and viruses can't touch it..That has to change, and linux community has to accept they are targeted too. And that initiative would be actually very good, because the way how Linux is open, it can be subjected fantastic level of peer review and actually be made really most secure OS on the world... But there is effort to be made, a huge one, and lots of work to be done. And not by keeping a head in the sand.And that effort is underway, luckily..In meantime, it's jungle out there.. Be careful !

author: Karel
author_rank: Super Contributor
timestamp: October 23, 2016, 05:15:55 pm
content: Quote from: 2N3055 on October 23, 2016, 01:15:47 pmI don't agree. People using a Linux system without av have less chance to catch malware than people using a windows pc with av.Most malware is targeted at windows users, they are the "lightning arresters" that take away the risk for Linux users.

author: SeanB
author_rank: Super Contributor
timestamp: October 23, 2016, 06:19:40 pm
content: Biggest DDOS attacks in the last week targeted all those IOT things running Linux, where the manufacturer decided that having hard coded passwords, no way to update the firmware, wide open ports and a crippled firmware were fine.

author: timb
author_rank: Super Contributor
timestamp: October 23, 2016, 06:34:13 pm
content: Quote from: 2N3055 on October 23, 2016, 01:15:47 pmAnd AV software is supposed to stop a zero-day exploit how exactly?Also, I'd like to see your evidence about all this Linux/macOS malware out in the wild. Please provide citations.

author: timb
author_rank: Super Contributor
timestamp: October 23, 2016, 06:37:02 pm
content: Quote from: SeanB on October 23, 2016, 06:19:40 pmAnnnnnd that's the fault of Linux how exactly? Under the same circumstances don't you think they would be just as insecure running an RTOS, Windows, BSD or Cisco iOS...

author: Halcyon
author_rank: Unknown
timestamp: October 23, 2016, 06:40:04 pm
content: Quote from: 2N3055 on October 23, 2016, 01:15:47 pmYou are absolutely correct. It's that old fashioned mentality that needs to change. People are using the excuses thatthey'venever had an issue before so why change and that the risk is far lower on Linux than it is on Windows. Yes, the risk is lower,but there is still a risk.

author: nctnico
author_rank: Super Contributor
timestamp: October 23, 2016, 06:40:57 pm
content: Quote from: timb on October 23, 2016, 06:34:13 pmIIRC there has been malware/virusses targetted at Linux and I wouldn't assume there is no malware for Linux even if there is very little proof it exists.

author: 2N3055
author_rank: Super Contributor
timestamp: October 23, 2016, 06:54:44 pm
content: Quote from: Karel on October 23, 2016, 05:15:55 pmI respect that you don't understand the issue here.. Not many people do because it is not very intuitive at first look.Number of let say 800000 malwares for windows VS 200 for Linux sounds like windows is in problem and linux is doing good. It doesn't work that way.AV vendors like to boast with sentences " we detect 750000 windows viruses".. And they show you database of ALL EvER detected malware variants.In industry term "threat set" is used to point to malware that is at any moment actively in circulation for certain platform... Threat set is very small number at any particular point. Sometimes even less than 10 per platform.. At many moments, you can't say which platform is more targeted, depending of attacks, groups active a the time and such....So not go into more detail, while at this moment statistically speaking you are STILL better off on unprotected Linux than unprotected Windows, I wouldn't be brave enough to say that would hold true in unprotected linux vs protected windows.... This world changes so quick, that something that was good advice a year ago doesn't hold true anymore.. Keep your eyes openAnd what I'm saying is not based on my beliefs or like or dislike on any platform.. I am a cybersecurity consultant to financial industry with 10+years in security and 20+ years in IT.. I run FreeBSD, OpenSUSE and Windows in my lab, and am responsible for machines running AIX and many more... I respect them all for their qualities and am painfully aware of their faults and inefficiencies..So please be safe and open minded and all will be well..

author: timb
author_rank: Super Contributor
timestamp: October 23, 2016, 07:03:38 pm
content: Quote from: nctnico on October 23, 2016, 06:40:57 pmI didn't say there wasn't any. I'm sure there is. I'm implying your risk of infection is much different.Think about it; if it was so easy to infect Linux machines you'd think it would be one of the bigger targets, since the majority of servers around the world run it. But they're not! That's because on a server, there's no user there to infect themselves by running attachments from strange emails, or software from strange websites. But that's exactly how workstations are infected!Let's take the example above, where someone gets infected by opening a "billing" email from their "ISP". I doubt that would have worked on me, because I show a few extra headers at the top of my emails; before I opened an attachment, I would have seen that the email didn't really come from Verizon, or Comcast or whomever.If I *did* click on something bad, I obviously wouldn't give it my root my password, so the damage it can do is very limited. If it used a zero-day sploit to gain access, well, there's nothing I can do about that anyway, is there?The key to all of this is to have *good* working backups. Hourly backups going back the last 72 hours, then daily backups going back the last month, then weekly backups going back the last year.That way, if you *do* get hit with some Cryptolocker junk, you can be back up and running within an hour or so.

author: 2N3055
author_rank: Super Contributor
timestamp: October 23, 2016, 07:12:03 pm
content: Quote from: timb on October 23, 2016, 06:34:13 pmI'm glad that you asked. Standard AV doesn't. Actually there is a discussion in industry whether payed for AV solutions provide better protection than free variants, because they both protect you well from known malware and have zero detection rate. But I'm not talking about AV software here.. It is about awareness that you might be targeted, and creating efficient security practice and attitude.With that particular zero day exploit I mentioned it was exactly that, that worked brilliantly. Since I knew I cannot blindly trust any platform, I designed security solution that used multiple overlapped independent security mechanisms that prevented payload execution... It went past two separate AV solutions trough mail, but it wasn't able to execute. At that point warning system reported something looking funny so I went to investigate. And discovered an attempt of attack.And all that because we didn't accept mentality "we have expensive AV so we don't have to worry!"And as a start , a nice whitepaper from 2015 that should give you a start..https://www.sans.org/reading-room/whitepapers/malicious/introduction-linux-based-malware-36097Best regards,

author: 2N3055
author_rank: Super Contributor
timestamp: October 23, 2016, 07:18:48 pm
content: Timb,Email didn't look funny at all.. It looked perfect.. Only way to distinguish it from the real thing would be if real ISP would use digital signatures, which they don't unfortunately....And you have a great point there: PEOPLE SHOULD DO BACKUPS!!That is most important thing.And linux servers are one of the most attacked target, and in industry, there are patches released all the time..If you know anybody that has to comply with PCI-DSS standard, ask them about attacks on linux servers and how much work it is to keep them certified..But your workstation is not on Internet and for it it is not so hard work...

author: Marco
author_rank: Super Contributor
timestamp: October 23, 2016, 09:48:58 pm
content: Quote from: nctnico on October 23, 2016, 06:40:57 pmI always assume my computer is rooted, but that I'm just not a big enough target and that the people who rooted it have bigger fish to fry than cryptolocker extortion.The root cause of all this is overdeveloped illusion of control and egocentricity, exemplified in every discussion about the lack of security of C in history ("I can do it right, what's the overwhelming evidence of language features massively increasing exploitable flaws in the face of that?").Here's some simple things which the industry should have agreed on doing at least two decades ago, yet they still don't.- C should be banned for most code on computers interacting with complex data formats from the Internet.- Processors should be able to efficiently support many process spaces, not just 2 (for compartmentalization of parts of the kernel still written in C).- ISPs which don't follow best practices should be liable to painful sanctions similar to CAs, if necessary simply kicked off the Internet or throttled to hell (majorly ingress&egress filtering, but also response to abuse reports from other ISPs, most of the IoT devices used in the latest set of DDOS's should be taken off the Internet nearly automatically).Also something I realized well over a decade ago, which thankfully happened a year ago (for my bank, after they had a ton of losses which they should have seen coming). Internet banking should have independent devices which force you to check transaction details before confirming them.

author: timb
author_rank: Super Contributor
timestamp: October 24, 2016, 12:39:48 am
content: Quote from: 2N3055 on October 23, 2016, 07:18:48 pmHere was my point on the ISP Billing exploit: If you looked at the raw headers of the email, you should be able to see what mail server it came from, right? If it didn't originate from my ISP's mail server, I wouldn't have touched it.---And actually, rethinking "Linux is the most attacked" bit, I would say web and mail servers are the most attacked targets; they just happen to mostly be running Linux, which means Linux is the most attacked target.I was in the web hosting industry for 10 years, and back then the biggest attack vector was PHP. When I sold my hosting company and went into consulting, I lost count of the number of systems that were "pwned" due to poorly configured Apache permissions and PHP. I'd get called in to fix it and, after tightening up everything, the customer would complain that their poorly written PHP-based CMS system would no longer work, because it required 777 permissions in the ~/html directory or some crazy shit like that. *Palm*At least it kept money flowing into my pocket. So long as there's insecure servers and script kiddies, security consultants will *never* be out of a job.But my point is, unless you're dealing with DSS certification or tons of financial information, which the majority of Internet facing servers aren't, then Linux is pretty easy to keep secure. You just need to stay up to date on exploits, which you can do by monitoring the development branches of the major packages you use (Apache, MySQL, etc.) and keeping them up to date. Using chroot and keeping permissions tight on pubic facing directories goes a *long* way as well.Once you've got a server running tight, it only takes about an hours worth of work per week to keep it that way, so there's really no excuse.And thanks for a link to that white paper, I'll have a read later!

author: Ampera
author_rank: Super Contributor
timestamp: October 24, 2016, 02:04:33 am
content: Quote from: Karel on October 23, 2016, 05:15:55 pmIt just takes one virus/worm that can spread very quickly to kill a lot of Linux machines. The naive thought that "It's secure if I don't let it do anything."or "It's secure, I bet a virus can't get through" is a bit self defeating. Antimalware/Antivirus programs are regularly updated to hopefully get you immunized before you can get a virus, sorta like how a vaccinewill help you. The idea of I will never be next to someone with the flu or malaria is comparable because in the same way it just takes one sad string of people who don't get vaccines to cause an outbreak, andthen it's game over. Same deal with AV/AM software. Saying oh I will never get it becuase Linux is secure might seem to be sound logic, but all it takes is one person to find a flaw that allows them to breakSU protection in some way, and it's game over for a lot of people.The risk is definitely lesser, but it exists and remaining unprotected forever might not be the best idea.It's a small amount of effort even if it is to go wasted, just like a vaccine, because once you get the malware, it's game over and you gotta hope you got good backups.

author: linux-works
author_rank: Super Contributor
timestamp: October 24, 2016, 02:21:21 am
content: Quote from: SeanB on October 23, 2016, 06:19:40 pmperfect example of the fault: THE VENDOR.cannot blame linux for when a vendor intentionally or just because they are clueless, deploy linux systems that were poorly secured.a fair comparison: get a good sysadmin or each platform and have them do their typical 'lock it down for public network use' procedure and then compare how easy it is to break into the platforms.iot vendors could care less and the fault for iot issues is 100% on them, not the linux operating system, itself.

author: Ampera
author_rank: Super Contributor
timestamp: October 24, 2016, 02:31:12 am
content: Quote from: linux-works on October 24, 2016, 02:21:21 amI find most of the iot stuff to be total bullshit. I dislike them and I think that sticking computers in fridges, washers, dryers, cookers, and whatever else is just something that should be reserved to the makers and hackers of the world, and they never should EVER be commercial products. It's just not needed to have a big android tablet bolted to your fridge, it never needed it. I am all for cool gadgets, but those in the sense of drones, home automation, and actually useful stuff, not an I'm too lazy to get up to see if we have another tub of ice cream so I will check my phone sorta deal.

author: madires
author_rank: Super Contributor
timestamp: October 24, 2016, 10:44:27 am
content: Quote from: nctnico on October 23, 2016, 06:40:57 pmThe linux malware in the wild is mostly targeted at servers, i.e. rootkits. Commonly rootkits are installed using securily holes in web2.0 applications, such as CMS, forum or plugins for those. If you run a web server, you'll see bots scanning your web server for files specific to vulnerable web applications. A simple 'grep' of the logfiles gives you a nice list of known security issuesThe whole process of scanning and installing malware is fully automated. There are also direct approaches to gain control by ssh brute force/dictionary attacks for example. Most of the ssh attacks come from IP addresses located in China, and increasingly from cloud services like Amazon or MS (carrier grade bots).

author: madires
author_rank: Super Contributor
timestamp: October 24, 2016, 11:18:41 am
content: Quote from: timb on October 24, 2016, 12:39:48 amFrom my POV mail servers are not really attacked, but bots are trying to send SPAM to your users, scanning for open relays or running dictionary attacks against the SMTP user authentication. Nearly all 'attacks' are just for finding a way to use your MTA for SPAMming. Scanning for known vulnerabilities in MTAs to gain control of your server happens too, but it's rare. More sophisticated attacks like taking advantage of zip issues in an antivirus is something directed at a specific target.Quote from: timb on October 24, 2016, 12:39:48 amYes, web 2.0 is a security nightmare.

author: nctnico
author_rank: Super Contributor
timestamp: October 24, 2016, 11:35:22 am
content: Quote from: madires on October 24, 2016, 11:18:41 amNow you bring back memories I rather forget... I once was co-owner of a small web design company and we had a dedicated server. At some point it got so many e-mail to process it could not keep up and hit the limit of the number of processes it could handle. I feared the server got somehow infected or was used as a relay but I couldn't find anything wrong and neither could the hosting provider. In the end I had to delete the MX record for the domain and change the domain name of the server to get rid of the problem.

author: Halcyon
author_rank: Unknown
timestamp: October 31, 2016, 08:32:40 am
content: For you Linux lovers out there, this video might be of interest to you. It's quite possibly something that can be blocked by AV/Anti-malware signatures well before you get around to updating your systemhttps://youtu.be/CQcgz43MEZg

author: voltsandjolts
author_rank: Unknown
timestamp: October 31, 2016, 09:06:06 am
content: Quote from: wilfred on October 31, 2016, 08:51:41 amCorrect. However, malware is normally developed specifically to attack bugs like this sometimes within hours of going public. Therefore, they are closely related.

author: setq
author_rank: Frequent Contributor
timestamp: October 31, 2016, 10:29:47 am
content: Dirty cow is a marketing name given to a relatively routine bug in the kernel so some security companies can get some marketing airtime on the matter. The severity is pretty low really. It requires local access for a start, which all bets are off if your attacker has that anyway.If you give your enemy a name... etc etc.To put things into perspective, they would run out of names if you look at the number of CVEs that pop up against Microsoft and Apple products, the latter of which had more than a few issues with RCEs over the last couple of years in trivial things like image format parsers.

author: Karel
author_rank: Super Contributor
timestamp: October 31, 2016, 11:37:31 am
content: Bottomline: you don't need av on Linux.The risk of catching malware on an updated Linux machine is much lower than on an updated windows pc with av.If you say that, despite the very small risk, Linux users should run av, than you should also say that people shouldn't use windowsbecause using windows instead of Linux increases the risk...

author: madires
author_rank: Super Contributor
timestamp: October 31, 2016, 12:12:34 pm
content: From what I've seen there's no good reason for AV on windows either, besides for users which are clicking every link, file, or whatever. Also in case of regulation or for reliabily issues a company might be required to have an AV. AV doesn't prevent 0days, crafted malware or brand new malware. Do you you remember any AV which hasn't caused issues like breaking windows with bad signature files or high CPU load? Or security issues, especially with corporate AV management tools. Corporate-wide shutdown of IT for a few days, because the the AV didn't thwart a new virus. Sorry, but AV is just scareware nowadays.

author: Zero999
author_rank: Super Contributor
timestamp: October 31, 2016, 06:22:25 pm
content: There are also different types of anti virus software. What most people refer to is memory resident type which scans everything in the background, which I do not use because I deem it to be a waste of resources. Then there's the type which can be used to scan the odd file here and there, which is what I use because it uses no system resources.

author: Halcyon
author_rank: Unknown
timestamp: October 31, 2016, 06:52:12 pm
content: Quote from: Karel on October 31, 2016, 11:37:31 amBottom line: If you are willing to take the risk and pretend that nothing will ever happen to you, go nuts. For those who want to take simple measures to reduce that risk even further, doesn't make them wrong. I'll repeat it again: This archaic "you don't need anti-virus/anti-malware/anti-bad shit on Linux" attitude is outdated and ignorant. If nothing else, even if you are an "expert" Linux user, one day you might just fuck up, because you are human after-all.Quote from: madires on October 31, 2016, 12:12:34 pmThis is the worst kind of advice I've heard in a long time. I really hope you aren't an IT 'professional'. I've worked in the IT industry now for almost 20 years so I know a thing or two. AV has saved my butt a number of times and has prevented something from being run or copied across already infected media. I hardly just go clicking on "every link, file or whatever".

author: setq
author_rank: Frequent Contributor
timestamp: October 31, 2016, 09:45:19 pm
content: Backups, incremental, save your arse, not antivirus. AV allows you to limp home. There are better strategies.I use windows defender and have done since windows 8 came out. That's more than enough.The worst infected shitboxes I've seen over the years do have active AV software yet are still chock full of all sorts of nasty. I've seen commercial environment horror stories with paid up AV still getting owned because of user education and the simple fact you can take a sieve and stick putty over all the holes. You have to take a bowl and make just the holes you need.

author: george.b
author_rank: Frequent Contributor
timestamp: November 01, 2016, 03:06:42 am
content: There was a novice who learned much at the Master's feet, but felt something to be missing. After meditating on his doubts for some time, he found the courage to approach Master Foo about his problem.“Master Foo,” he asked “why do Unix users not employ antivirus programs? And defragmentors? And malware cleaners?”Master Foo smiled, and said “When your house is well constructed, there is no need to add pillars to keep the roof in place.”The novice replied “Would it not be better to use these things anyway, just to be certain?”Master Foo reached for a nearby ball of string, and began wrapping it around the novice's feet.“What are you doing?” the novice asked in surprise.Master Foo replied simply: “Tying your shoes.”Upon hearing this, the novice was enlightened.

author: Ampera
author_rank: Super Contributor
timestamp: November 01, 2016, 03:36:59 am
content: Kinda annoyed the delete button doesn't work so I can undo this mess.I wanted it for my own sake, I would have gone on without it, just wanted to see what was out there. I am aware of the better security of Unix/Linux based systems, but I could gives a rat's ass about how secure it is. I wanted to have SOMETHING there even if it was some small thing. The risk exists and I want to remove it.What other people agree is honestly up to them, I asked a question and got an argument, and not a nice debate either.Thanks to everybody who has given real answers and not just gone on about how Linux is perfect and doesn't need protection. Windows by the same logic needs no protection because if you don't run it it can't infect you. I got news, if I give a program SU, an action I tend to do since most of my programs require it, it can do whatever it bloody wants to my system. And if an argument is that I should make sure my software is clean before I run it, I don't have an Antivirus so I can't do it. It is BLISTERINGLY easy to bust a Linux system once a program gets SU, and I want to know what programs I can trust, and if I've made a mistake a way to fix it. Windows is pretty damn similar, programs have no root access unless you give it to them, yea Windows has more ways to get around that, but if a program asks for SU access within reason, I am gonna grant it to get it to do what I downloaded it to do.Without SOME antivirus I have no defense against sketchy sites. A lot of sites will offer perfectly fine software and look not the best (look at LWJGL's old site, not to mention a lot of soundfont sites look like rubbish, list goes on and on) and a lot of sites offer lemons. With no tool to scan anything I can't know what I can trust or not. That is why I want an antivirus, never mind the idle security of an operating system and how easy it is to crack SU, my concern is GIVING SU without knowing what it will do, something I can't figure out without (again) scanning it.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: November 01, 2016, 03:55:37 am
content: Quote from: TwoOfFive on November 01, 2016, 03:36:59 amI haven't read every post on this thread for exactly the reasons the OP has outlined. But I will add a few points endorsing exactly what he has said.1. There are many useful and specialized pieces of code out there that pertain to the electronics field. Many of them are works of love by a volt nut, or synthesisor nut or whatever. They are not professionally developed or maintained and are often posted on an equally amateurish web site.2. These web sites are at least occasionally hacked. The original coder is NOT passionate about web site maintenance, he or she already has an all consuming passion. It may be hours, or days, or weeks before they notice.3. There is malware targeted at Linux systems. It is rarely a problem for all of the reasons that everyone can enumerate, but does that mean that it should be totally ignored?4. One of the primary reasons Linux is not heavily targeted is that it has low market penetration, and a much higher percentage of Linux users is technically competent. This may change as Microsoft and Apple do things to drive their revenue which will alienate more and more users.The OP is asking a question about a simple bit of prudence which would have little or no impact on daily operations. No reason to bring fire down on him.

author: BradC
author_rank: Super Contributor
timestamp: November 01, 2016, 04:52:57 am
content: Quote from: TwoOfFive on November 01, 2016, 03:36:59 amNow you know, so you won't do it againQuote from: TwoOfFive on November 01, 2016, 03:36:59 amOn the topic of AV, I use F-Prot & ClamAV. I have them installed on a basic live-cd & USB so I can help out in cleaning broken windows machines. I also use them to periodically run over servers that are exposed to Windows machines. My Zimbra server uses ClamAV to scan all incoming and outgoing mail. It misses a huge percentage of zero-day or even vaguely recent stuff that my users are educated not to open. In fact Greylisting inhibits more stuff than ClamAV catches. None the less, it's nice to have. I run both of them because all AV products are horrible and have huge failings, but running the two of them side by side makes a noticeable improvement in my detection rate.One thing you'll want to learn how to do is not give random software root privileges. Using su or sudo on random software is a practice you'll want to learn to get away from. Dismantle install scripts and figure out how they work. Install software into your home directory (~/local is nice). Just learn how to avoid having to get root privilege. Unix has relatively fine grained access control. Learn how to set up your groups so you don't need to get root to do stuff.Yes, linux has virus/trojan/worm/whatever the new fruit is this week. Hell, a few years ago I set up a world facing server with an account with the name and password 'backup'. I did it when I was testing in staging on an isolated network for a 10 second test and I forgot completely about it. 2 days after putting the box onto a world-facing IP I had a daemon running on the backup account ssh scanning swaths of IP address space trying to get root on boxes. Now admittedly AV would not have helped me avoid my complete brain-fade, but it proves there is stuff out there trying to get in and if you do something dumb and leave the door unlocked you'll be rapidly compromised.Sorry for the ramble, but learn how not to need root on a day to day basis. It'll make things a bit safer. If you really want to run AV, then do it. It may or may not help, but if you are willing to put up with the hassle then it can't hurt (as long as you are not going in with the attitude that it'll save you from doing something dumb).

author: Karel
author_rank: Super Contributor
timestamp: November 01, 2016, 07:57:45 am
content: Quote from: CatalinaWOW on November 01, 2016, 03:55:37 amAgreed.Quote from: CatalinaWOW on November 01, 2016, 03:55:37 amAgreed.Quote from: CatalinaWOW on November 01, 2016, 03:55:37 amWow, the year of the Linux desktop is arriving? Really? You'r kidding, aren't you?A system, designedbyengineers, designedforengineers, isnevergoing to reach mass adoption.But hey, maybe I'm wrong, maybe we will see the year of the Linux desktop...

author: madires
author_rank: Super Contributor
timestamp: November 01, 2016, 01:18:06 pm
content: Quote from: Halcyon on October 31, 2016, 06:52:12 pmYes, AV protects you from old and known malware. But it doesn't do that for the latest malware and crafted stuff. When I compare how many times AV saved the day with how many times it ruined the day or missed really bad stuff, I don't see any benefit in buying an AV product. MS offers free malware protection since XP, it's not the best but it's ok. I've seen nearly all professional AV products over the years. They all have/had security issues, miss(ed) bad stuff, crash(ed) computers, ruin(ed) windows. Ever experienced that half of the PCs in the office didn't run, because the AV had quarantined an essential OS file? That's fun! And it happened too many times.

author: madires
author_rank: Super Contributor
timestamp: November 01, 2016, 01:32:33 pm
content: Quote from: BradC on November 01, 2016, 04:52:57 amI've usedhttps://www.botfree.eu/en/index.htmlseveral times successfully.

author: Karel
author_rank: Super Contributor
timestamp: November 01, 2016, 04:01:12 pm
content: The purpose of av is to make the owner of the pc feel better and let him/her think he's protected.And, ofcourse, to fill the pockets of the av vendors.Even if his/her pc is part of a botnet, as long as your av is running & up to date, everything is ok... o wait..."Antivirus software is now so ineffective at detecting new malware threatsmost enterprises are probably wasting their money buying it, an analysisby security firm Imperva has concluded."http://www.cio.com/article/2390136/antivirus-software/antivirus-software-a-waste-of-money-for-businesses--report-suggests.html

author: Ampera
author_rank: Super Contributor
timestamp: November 01, 2016, 05:39:15 pm
content: Quote from: Karel on November 01, 2016, 04:01:12 pmI don't even want to pay for a Linux AV. Most of the linux software is free and open source, so I could imagine some form of antimalware being the same.

author: ataradov
author_rank: Super Contributor
timestamp: November 01, 2016, 06:59:22 pm
content: Quote from: TwoOfFive on November 01, 2016, 05:39:15 pmNope. Open source people realize how silly it is, so they don't bother making anything like that. Commercial people realize that too, but they are in it for the money.

author: mtdoc
author_rank: Super Contributor
timestamp: November 01, 2016, 08:26:47 pm
content: Quote from: george.b on November 01, 2016, 03:06:42 amWell done!

author: george.b
author_rank: Frequent Contributor
timestamp: November 02, 2016, 01:54:19 am
content: Quote from: mtdoc on November 01, 2016, 08:26:47 pmOther such pearls of enlightenment here:http://catb.org/esr/writings/unix-koans/In all seriousness though, under both Windows and *nix, I find it unnecessary to have an AV eating up my system's resources. On my laptop, running Windows 7, Windows Defender is unobtrusive enough, so I leave it there. Every once in a while, when I'm particularly bored, I install some other antimalware and do a full scan. Other than sketchy stuff which I knew was sketchy when I got them (and thus didn't get infected by them), things have been clean every time.

author: madires
author_rank: Super Contributor
timestamp: November 17, 2016, 03:25:35 pm
content: Antivirus tools are a useless box-ticking exercise says Google security chap:http://www.theregister.co.uk/2016/11/17/google_hacker_pleads_try_whitelists_not_just_bunk_antivirus_ids/

author: madires
author_rank: Super Contributor
timestamp: November 19, 2016, 12:37:55 pm
content: Security Advisories Relating to Symantec Products - Symantec Norton Client DLL Pre-Loading Uncontrolled Search Path Elevation of Privilege:https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2016&suid=20161117_00#_SYM16-021_/_SymantecSeveral Symantec AV products allow an attacker to run arbitrary code under Linux, MacOS and WIndows. Yes, it's really bad. Affected products are Symantec Endpoint Protection Cloud Client, Symantec Endpoint Protection Small Business Enterprise Client, Norton Family, Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security and Norton 360.

author: rrinker
author_rank: Super Contributor
timestamp: November 19, 2016, 06:18:36 pm
content: Symantec AV products - not even once. They are well-know for causing any number of issues on Windows platforms, no way would I trust them on anything else. I try to direct people away from their garbage, but we have plenty of clients who use it as their corporate-wide solution, often because of the central management - which they set once and never look at anyway.

author: Halcyon
author_rank: Unknown
timestamp: November 20, 2016, 03:41:47 am
content: Quote from: rrinker on November 19, 2016, 06:18:36 pmI'm with you. Apart from the old DOS version of Norton Ghost, I would never touch another Symantec/Norton product. They are horribly bloated and just bloody annoying. There are far better products out there (paid and free).

author: rrinker
author_rank: Super Contributor
timestamp: November 20, 2016, 04:18:57 am
content: The DOS products under the Norton name were actually designed by Peter Norton - he actually had something of a clue when it came to software design. he also wrote a nice learning to program in DOS column in one of the magazines at the time. Then I guess he got tired of running a company and sold the products and the rights to use his name. A shame, the original Norton Utilities were a must for anyone doing any work on MSDOS computers.

author: madires
author_rank: Super Contributor
timestamp: November 20, 2016, 12:52:47 pm
content: Quote from: Halcyon on November 20, 2016, 03:41:47 amUnfortunately that junk is the typical bloatware coming with new PCs and laptops. It's the first thing I remove

author: Karel
author_rank: Super Contributor
timestamp: November 20, 2016, 03:02:18 pm
content: Quote from: madires on November 20, 2016, 12:52:47 pmThe same with windows...