During my education process, I have heard the following myth uttered by a few students, and even a professor or two: "Linux isn't really more secure than Windows, it's just that Windows is a bigger target, and attracts more attention from the hackers."
This is absolutely false. In the web-server market, Apache is the dominant force. If I want a big target, apache is the way to go. And of course, Apache is most commonly found on Linux servers. So Linux is *NOT a smaller target.
There are two major and concrete reasons for Linux's superior security record.
The first, is the structure of the UNIX file system. Being a copy of Unix, Linux inherited Unix's basic file structure. Because Unix was a multi-user operating system from the start, Unix has built in security measures to keep users from accessing files that they are not authorized to. While not perfect by any means this is an advantage when compared to Windows based systems that started as a single user operating system giving the user full access to everything.
The second, and perhaps the most important reason is simply "peer review." Peer review is common in almost every discipline EXCEPT software engineering. The concept is simple; before your idea is accepted as valid, it must FIRST be independently reviewed by a body of qualified peers. An example of this is Civil Engineering. A city government would never consider awarding a bridge building contract to a firm until a thorough outside review concluded that the design was for that bridge was architecturally sound and valid.
In the open source community this practice is the norm. Every bit is public knowledge and ever algorithm is exposed. When flaws are discovered, either the discoverer patches it, or the author of the software is notified of the error. Conversely, commercial software makers keep their code a secret and simply HOPE that attackers do not discover their holes.
If and only IF Microsoft allows their code to be validated by outside engineers will they EVER be as secure as Linux. That "bigger target" myth is simply a bunch of BULL.
IFOSSLR – First Issue
7 months ago