When and if Linux becomes a serious competitor (in market-share) in
the desktop market and we have countless grandmas and technology
clueless people using Linux and 20x the malware being written for
Linux, we may see a different set of statistics. One could also
speculate that to get to be a serious desktop competitor, Linux may
have to make more compromises and leave themselves a bit more open to
this stuff as well.
I doubt it. Linux can do just about everything Windows can do now -
unless you're counting things like embedded ActiveX controls and COM
stuff which I doubt even most of the corporations are bothering to
use. Certainly naive end users aren't doing anything with that stuff.
Most end users use a very small percentage of the capabilities of any
OS. I've seen nothing to suggest Linux needs to change its approach.
If anything, it could go the other way - things like "user mode Linux"
which allows one to run a kernel on top of another kernel and lock
users into using the uppermost kernel as a security measure.
Third, Windows has more susceptibility for things like this. How much
so is difficult to objectively measure. It is clear, IMO, that the
difference is nowhere near the implication of 10,000 Windows viruses
versus 20 Linux.
Objectively measuring it is indeed difficult. However, the fact
remains that the bulk of malware is on Windows, not Linux. While I
believe the main reason for that is the relative abundance of Windows
vrs. Linux, and I do believe the situation will eventually get worse
for Linux, the bottom line is that Linux and UNIX in general has been
DESIGNED for better security than Windows. Even Microsoft's own
corporate security people have acknowledged this in the past publicly.
And if Linux is ever used by half a billion people, I suspect the
amount of effort put into supporting that by the open source community
will benefit from the "eyeball" effect and render Linux even MORE
secure. It's not clear whether more users means exposing more
vulnerabilities faster than they can be fixed or not. I think it
depends on the development method - and here open source has an edge
on proprietary since more people are involved in development and code
review. While this is not a guarantee against vulnerabilities in the
first place, as some may claim, it does seem very true that fixes are
faster in the open source community than in proprietary development.
There was a recent article somewhere that analyzed the time between
discovery of a vulnerability and availability of a patch, and I think
Linux came in ahead of Microsoft by some days on average.
Fourth, related to # 2 and #3, above - default configuration settings.
A knowledgable Windows user can make a Windows box almost as secure as
a Linux box. I do think Linux has the edge, though. One of the
problems is that with Windows it takes more work to make it fairly
secure. There are a lot of default configuration settings in Windows
that makes for an insecure system. There are (or used to be) some
like that in Linux too, but not as many. Microsoft is finally making
some changes in this area. One of the primary reasons they were
touting Windows 2003 Server as their most secure was because of them
changing default configurations. On the desktop scene they are going
to start doing stuff like enabling their (slightly better than
worthless) built in firewall and turning off mostly useless services
like the Messenger Service.
If you look at most of the Windows problems, it does not seem like
they depend on default configurations. Some do, more in the past than
now, true. But many of them clearly depend on Windows services being
coded insecurely - buffer overflows and the like. The same is true in
Linux - most of the vulnerabilities you see are the result of poor
security coding practices. I suspect Linux has better security
primarily because people who code for Linux are more competent than
the college grads Microsoft hired with no real-world coding
experience.
And if you turn off all the vulnerable services, there goes Windows
so-called "flexibility".
And TWO - almost THREE - YEARS after Microsoft promised an intensified
concentration on security and instituted a code freeze to re-examine
all their code, there are still new vulnerabilities cropping up on a
weekly, if not daily, basis. Microsoft has now announced yet ANOTHER
round of "devotion to security". Meanwhile, Gates himself was
recently quoted as saying security was no big deal and users should
just apply their patches and shut up. It should be obvious that the
corporate hierarchy in Microsoft simply is NOT interested in security.
In any event, Linux is far more secure against at least viruses now
and for the foreseeable future than Windows will ever be.