10 Reasons We Shouldn't Blame Windows For Our Security Issues?

As in sociology, in terms of security there are those that emphasize the individual (the user) and others that tip the balance towards structural determinations (the operating system). The first of these is the case of this article published in eWeek which prompted me to write this answer. In reality, the individual acts conditioned by the structure; This means that, although it has a certain degree of autonomy, its scope for action is limited and conditioned by the structure. As far as security is concerned, the same thing happens. Although the user has part of the responsibility regarding the security of the system, there are structural conditions that limit and condition the actions of the users. This quasi-philosophical reflection is relevant because it is very common to hear among Windows defenders that, in reality, all the blame is on users and / or third-party programs (which are full of security holes). The question that arises is: is this computer "illiteracy" not encouraged and caused by Microsoft? Isn't accusing third-party program developers really a scapegoat? The real interesting question to answer is: why doesn't this happen in Linux?

Let's see what are the 10 arguments most used by Microsoft and its defenders to argue that Windows security flaws, in truth, are not Microsoft's fault. The fault is always the others ...

1. Third-party app security holes

Third-party applications can cause major security breaches on a Windows PC. Third-party programs do not always have adequate security measures in place to ensure that data is kept secure. To make matters worse, applications are not always updated frequently enough. That is a problem. Hackers are fully aware that some programs are easier to break than others, so they attack easier targets.

The Linux way:
It never ceases to call my attention how ungrateful the guys at Microsoft are: to clean up their prestige they blame the developers of Windows programs. It is not that Windows is insecure, but that the programs that other companies develop and that run in Windows have many security holes. The truth is that, if anything, that answer still dodges the question: why do those programs (for Windows) have more security holes? Are Windows programmers idiots? No, the problem is in the way the most popular Windows programs are written, almost all of them being proprietary software. On the other hand, there is the question that, in Linux, the programs are updated through the repository system.

2. Outdated software

Generally, third-party applications are updated by the developer himself. There's just one problem: users don't always update programs. We have all been there. We are in the middle of something important and a program we just opened asks us to update it. Instead of waiting for the update and potentially being forced to restart the computer, we leave it for another time. This may seem like the best option at the time, but it really isn't. If the update was a security patch, we would be putting our computers at risk for an even greater amount of time than we should. If we don't update our third-party programs, there's not much Microsoft can do to protect us.

The Linux way:
Updates are made through the repository system. This has numerous advantages: it is done centrally, from a secure source, in the background (without interfering with what the user is doing, even when it comes to updating the program he is using) and generally does not require the user to reboot the system. Furthermore, as it has been built in a modular way, Linux can be updated "piecemeal": it is not necessary to wait for a kernel update to correct a bug in the boot, the X environment, etc.

3. Antivirus and anti-spyware out of date

Running anti-virus and anti-spyware programs that are not fully up to date is almost as useless as not running anything at all. As new security holes are discovered, manufacturers are releasing updates to their programs to keep user data safe. Unfortunately, providers cannot force users to update their programs. Thus, a user who chooses to wait or cancel the update puts himself at risk of being affected by a problem that could easily be avoided with the help of a simple patch. True, Microsoft should have done a better job of making Windows more resistant to viruses and spyware, but it also needs some help from users.

The Linux way:
One of the first things a novice Linux user discovers is that an antivirus doesn't seem to be necessary. It is striking because, despite this, Linux is considered a much more secure system than Windows. The reality seems to indicate that antivirus, although they can help control or avoid some of the effects of malicious programs, do not attack the causes and conditions that allow their reproduction and massiveness on Windows systems. Besides the fact that there are far fewer malicious programs (viruses, malware, etc.) for Linux, it has been proven that almost none of them seriously compromise the OS. I know it can be counter-intuitive for a Windows user but no antivirus makes your OS more secure. In any case, the need for an antivirus reveals the gaps and security flaws of the host OS.

4. Users open attachments they shouldn't open

Microsoft should not be blamed for a user opening an attachment that he or she should not open. In other words, Microsoft cannot be blamed for the stupidity of Windows users. If someone really believes that they have won the lottery, that there is a magic formula to enlarge their private parts, etc. you deserve to be infected by a virus. We all know that unless we are expecting that attachment from, of course, a known source, opening attachments is never recommended. For years, hackers have been using email to take advantage of users who never found out that opening an email attachment from an unknown sender is a bad idea. As much as security vendors and Microsoft have tried to raise awareness of this issue, users are simply not listening.

The Linux way: 
Ehh… no attachment can be executed. Easy. To execute a file, it is not enough to "double click". The user will have to save it, give it execution permissions and, only then, can they execute it. On the other hand, thanks to the huge community that was built around Linux, its users are continually educated about the potential dangers of granting execution permissions to programs received from untrusted sources.

5. Users browse dangerous sites

In recent years, companies like Google have helped protect users to only browse safe sites. But that doesn't stop heavy users from using Internet Explorer, Firefox, or any other browser to browse sites that contain malicious files. Likewise, there are victims of phishing attacks on sites that look like a real page, for example email or a banking website, in which users fill in their data believing that it is the real page, when in fact not it is. Huge numbers of people continue to browse sites that wreak havoc on their computers or their lives. Hopefully after being burned once, these idiots learn their lesson.

The Linux way: 
It is very difficult to prevent users from browsing pages with malicious content, but there are some structural aspects that influence the actions of users. First of all, Linux users don't have to search for or install "cheat" programs, or look for cracks or serials on dangerous pages. Furthermore, Linux users are rarely so desperate to remove the suspected virus as to download and install any so-called virus "remover" from insecure or untrusted sources. Second, the default internet browsers on all Linux distributions are much more secure than Internet Explorer.

6. Where are all the passwords?

Some users make it too easy for malicious hackers to gain physical access to their computers. Without a password to control access to a machine, anyone can sit at someone's desk, boot up the PC, and start stealing confidential information. Today, companies around the world require users to password protect their machines so that criminals cannot access their data. Why don't people apply that lesson to protecting their home PCs? Yes, it might be a pain to type in a password every time the computer "wakes up," but it helps to keep data confidential.

The Linux way: 
Linux distributions are configured in such a way that to perform potentially dangerous actions the user is asked for the administrator password. Lastly, most of them lock the keyboard after a few minutes without activity. Execute permission limitation is the area where the latest versions of Windows have made progress but are still light years away from Linux.

7. The passwords are there, but why are they all the same?

Having a password is a great first step, but having the same password for everyone makes your system and the information stored both on your system and on the web very difficult to protect. It can be very comfortable but it is not very safe to say. Any hacker after obtaining one of your passwords, the first thing he will do is test if it works in another of the services you use. If so, he will have access to everything he wants. Passwords must be tough to crack and vary from site to site.

The Linux way: 
In Linux all passwords are encrypted and stored in a Keyring. In order for applications to access these passwords, it is necessary to enter the main password of your Keyring. That way, you don't have to remember thousands of passwords, just one.

8. Run in administrator mode

A common mistake is running Windows in administrator mode. This can make using the PC more convenient, but it also gives malicious hackers access to do whatever they want on the PC. Some security experts say that getting used to limited users could eliminate many of the security problems that plague the average Windows user today. For its part, Microsoft could do a better job of informing the public about the dangers of administrator mode. But again, if a user wants to run as administrator, what can Microsoft actually do to stop it?

The Linux way: 
Once again, the installers of the different Linux distributions agree on one thing: they all force you to create a user with limited services, who will be the user of the machine, and they also force you to enter an administrator password. In this way, you can log in with an ordinary user, with limited execution permissions, and within it, some potentially dangerous actions can be executed only if the administrator password is entered first (thus avoiding having to log in as administrator, etc.). This way of doing things greatly limits the destructive potential of a malicious program but gives the system enormous flexibility.

9. Windows updates

Windows updates could spell the difference between security and a security breach on the user's computer. As annoying as they are, Windows updates are an integral part of your computer's security. Every time Microsoft releases patches to its operating system, users must be ready and willing to update Windows as soon as this update is available. If not, they are prone to putting themselves at risk. Microsoft can only recommend that users download a security update and provide patches whenever possible. What users decide to do next is up to them.

The Linux way: 
As we saw, Linux updates are much more transparent to the user. Added to this is the fact that, being a modular system, Linux can update its parts without having to wait for a "major update". Additionally, Linux is known for releasing updates and patches (including security ones) faster than its Redmond counterpart.

10 Education

It's easy to blame Microsoft for security in the face of user problems, but sometimes users have to easily realize that education could help them avoid many of the problems that plague them on a daily basis. With better security education, the network would be a safer place, thanks to fewer users looking to view malicious sites. Opening infected attachments would be less of a concern, as users would know how to deal with them. With better education, there would certainly be fewer outbreaks, which would mean a safer work environment for everyone.

The Linux way: 
As we saw, many of the problems in Windows that are considered a "lack of security education by users" are also structural problems caused by system failures. The combination of both makes Windows a very insecure system. In Linux, contrary to popular belief, not all users are hackers, which is demonstrated by the growing popularity of "newbie" distros like Ubuntu and others. However, it is true that there is a greater awareness of security, but this is because Linux promotes an active attitude on the part of users and encourages their curiosity to find out "how things work". In Windows, on the other hand, the passivity of the user is always sought and the concealment of the true functioning of things. Similarly, nothing is done to 'educate' the user.

Synthesis.

Microsoft is certainly not innocent of the security problems that affect Windows or its software. But it is not always to blame. And it is important to remember that. This is what the "defenders" of Windows say.

In truth, user action does not take place in limbo nor can it be considered ahistorically. Windows users act with a certain autonomy, but always conditioned and limited by the characteristics of the OS and were "educated" in the practices that it allows and promotes.

In that sense, in Linux there is the combination of the best of these worlds: a very strong community, which helps in the awareness of its members regarding security and other matters; an operating system that is generally distributed with more restrictive and secure configurations, but at the same time more flexible (inability to execute attachments, main user with limited privileges, etc.); and with its own characteristics that make the system more secure (repositories that allow installation from reliable sources, faster and more secure updates, "modular" and multi-user construction, etc.).