A security myth about using alternative software
One security myth is that when alternative software (like Linux, OS X, Firefox, Thunderbird, Open Office, and just about any non-Microsoft product) becomes as popular as the MS equivalents, there will be just as many viruses, malware, and security vulnerabilities as we have with MS products.
The thinking behind such statements is fairly simple.
- Software is difficult to produce.
- Therefore all software contains bugs and malware authors exploit those bugs.
- Therefore the only thing keeping alternative software free of the security problems we deal with in MS products is a lack of interest (and incentive) on the part of the malware creators. If you're going to spend time researching and writing a virus that will cause damage to computers and networks, you want it to cause as much damage as possible.
- Therefore when alternative software becomes more popular, malware authors will begin to target it just as much as they target MS software today.
Unfortunately, this type of thinking isn't sound. Item 1 is true.
Item 2 is true to an extent. Yes, all software contains some type of bug. (We can define "bug" in the broadest sense as any unexpected or unwanted behavior.) All bugs are not exploitable system-wide security vulnerabilities. The total vulnerability of a system depends, to a large extent, on the background security policies of the operating system. An insecure OS, like Windows, allows many user-level software application bugs to be escalated into system damaging problems.
Item 3 is partially true. It's true that malware authors target Windows systems and software. Part of the reason for this is the dominance of MS products. The other part of the reason is that Windows systems have design flaws which allow malware to do the maximum amount of damage possible. So if you're going to write a virus, you not only want it to affect the largest group of people, you also want it to have serious and damaging effects on their data. The well-known Windows vulnerabilities allows malware authors to have those damaging effects. Linux and OS X lock normal users out of critical system functions and software for this exact reason.
Item 4 isn't true. Malware authors will want to target alternative software when it becomes more popular. However, there's a limit to what they'll be able to accomplish in that regard. The amount of success they'll have depends on the quality of the software and the security built into the operating system. Look at the problems that have plagued Windows XP in the past, up to now. At first XP was full of holes, as were Outlook Express and Internet Explorer. As time went on MS was able to patch those vulnerabilities. There are still problems with XP, OE, and IE, but not as many as there used to be. If malware mayhem is completely dependent on the will of the author, we should be seeing just as many Windows vulnerabilities as we were seeing in the past.
Where there's a will, there's not always a way. Software quality and operating system security do make a difference. If you choose your software wisely and learn to use it effectively, you'll be much better off.
