Security is an insanely broad topic. As an average desktop user, keep your system up to date, and don’t run random programs from untrusted sources (most of the internet). This will cover almost everyones needs. For laptops, I’d recommend enabling drive encryption during installation, though note that data recovery is harder with it enabled.

There’s a lot of people with the idea that open source can’t be secure because people see the source code.

But imagine this. You have 2 locks, one that is completely viewable of the innerworkings, and another that is covered, both have been unbreakable, but could you imagine the balls on the guy that made the clear lock? Imagine feeling so confident that your lock was clearly the best, that you just expose it to any hacker ever and they still can’t get in.

Microsoft can barely get things working with their closed source code.

In reality, anything is exploitable and hackable eventually. With the open source community there are so many eyes on it that when someone notices that the program is running 2 seconds slower than it used to, they discover a vulnerability instead of just accepting it and saying “probably MS doing some BS” and dealing with it.

Windows has a lot of shit to second guess the user. Linux doesn’t. Linux doesn’t babysit you. It has some guardrails but the general idea with Linux is it’s your computer, it will do what you tell it do, even if it’s a bad idea. This makes things lighter, faster, more private, but it has also led to security incidents.

Windows and Mac will watch what you are doing. If they see something suspicious, the security software can jump in and telemetry means they can notice patterns as new malware appears on their users machines. This makes the machines slower and heavier and less private, but also easier for users to deal with because they doesn’t have to actually know anything. They can just buy their way out of a problem with superdupertotallaylegitantivirus2025pro.

Anyone who says Linux doesn’t get viruses is lying to you. It does. They all do. But it’s not that common because Linux is a smaller market share so most nefarious people won’t waste their time on a smaller target unless there is something that specific target has they want. So old people using fedora kinoite to access email and facebook are fine, but Pete Hegseth watching ignoring security practices and visiting shady sites is probably a worthwhile target and could be vulnerable.

Linux has major advantageous over the industry approach of “we know best” but it also has disadvantageous. If you are the kind of person who wants to learn and improve and grow, Linux could work for you. If you are more the irresponsible buy-someone-else’s-solution-to-my-problems type, it’s not.

Microsoft being closed source hides their bugs and vulnerabilities. Even when security researchers have sent in reports MS has sat on them due to profit being motive not security, and not taking vulners seriously until the researchers say screw that and publish it.

Linux being open can have all eyes on it, and if there is an exploit, there is a community willing to help ASAP.

On many distros you may have weekly or even daily updates or patches coming through with fixes. A distro like OpenSUSE has various patch and list patch commands that show what security patches are avilailable, their status (critical, recommended) and if it’s needed on your system or not depending on what you have installed. You don’t get transparency on closed source systems.

If you are paranoid about security you can use AppArmor tools or SELinux. AppArmor can be set to learn how an app behaves, then you lock it so the app can’t do new things.

SELinux you set rules for files and folders, so even with remote access an attacker can’t access data if rules don’t allow file listing over SSH etc

Security on Linux is lackluster.

Generally as long as you don’t install any untrustworthy programs you’ll be safe … but there’s a problem. Linux is an amalgamation of thousands of separate programs and most of them are maintained by one guy in Nebraska thanklessly. XZ Utils is a prime example of how vulnerable the Linux software stack is to malware.

My advice: Keep your daily driver separate from your gaming machine, use a debian-based distro like Ubuntu or Mint for your daily driver, and always have a disaster recovery plan. My advice would basically be the same for a Windows user.

EDIT: Also full-disk encryption. Both on Windows and Linux you can just read the contents of a hard drive no questions asked. Windows is going to address this with TPM’s but you can just use a password. Secure-boot is good because it can help guard against rootkits.

So how can I as a new user make sure to have the most secure machine as possible?

Shut the computer down. That’s it; computer as secure as possible.

Otherwise, if you actually want to use your computer, google for “threat model” first.

But generally: use an adblocker in your webbrowser, don’t execute random commands/tools from the internet before you know for sure what you’re doing, update stuff now and then and make backups.

You don’t actually need “perfect” security in the future, any more than you did in the past. Windows was not perfect, right? So stop looking for perfection. Instead, look for “good enough for 99.9% of the world”. And you can get that with many of the popular Linux distributions.

Basically, install a popular distro, and keep your software to whatever is in the package manager. Don’t install random shit manually. Don’t download random software from random websites. Don’t fuck with security settings unless you read up on the topic very thoroughly. Then you’ll be fine.

Linux is always more secure than win10, so whatever your need, Linux is more secure. The biggest threat is almost always yourself, and what you open up, give away, and how easy you make the codes you use and so forth.

Just make sure everything’s updated.

Microsoft do a good job of updating drivers and their applications, but Windows application updates vary so much.

For Linux - mostly - the distro maintainers handle all updates and just updating is usually enough.

After that it’s down to you… if you disable all the built-in protection and visit dodgy websites then any OS is going to struggle.

You can improve the out-of-box security by removing software you don’t use, improving default configurations (one size doesn’t fit all) and considering if you want additional security software - this applies to any OS.

So, to return to your question, choose a Linux distro which has regular updates and only contains applications that you use.

Keep your user account in user space.

Avoid unnecessary root access.

From a windows perspective Linux does 2 things differently which makes it more secure to Windows.

1. Like MacOS it doesn’t need antivirus software like Norton. Windows needs antivirus because DOS the OS windows is based on, had it where any program had access to anything. This is still sadly true even on Windows 11. Linux is Sandboxed, where instead of giving the program full access to everything, you just give it a sandbox with what it needs.

Unless you deliberately run a program as the admin of Linux (su or sudo), malicious code can just delete system32.

2. Linux’s is open source and while the desktop market share is tiny, there are a massive market in servers. As a result since there are a lot of eyes on the project if/when problems are found they are fixed quickly. I remember a time when a malicious actor was trying to add a backdoor into a library as a blob and it was caught.

Windows on the other hand is closed source, meaning if MS can’t find the issue, the only time it is found is when it’s in the field. To avoid downtime MS offers bug bounty programs for those who can find issues, rather than to let them exploit it.

if you mean the most secure desktop? then linux is not. not by a long shot. use windows.

https://madaidans-insecurities.github.io/security-privacy-advice.html#desktop-os

https://madaidans-insecurities.github.io/linux.html

if you mean most most free, linux it is. personally I use linux.

Others have said it before but basically : what is YOUR (not me, not your best friend, nor your colleague, etc) threat model?

To clarify that means WHO is actually trying to threaten your security?

Typical for most people it would be :

• scammers trying to get pieces of your identity or your local cryptocurrency wallet or resources they can use to repeat that on to others.

For some people, like activists or political journalists it would be :

• national actors, e.g. governments, with their surveillance apparatus, who might end up on a list with a set of conditions that would trigger some automated scan to get e.g. Signal logs

For very very few people, say Edward Snowden, who within the previous group actually did trigger some action :

• actual team of hackers trying to hack into their devices

So as you can imagine if you are part of group 1, 2 or 3 then way you will protect yourself is totally different. What you will also have to protect is also different, e.g. if you have no cryptowallet but are traveling you might have to protect your phone physical phone and its data.

So… if you are serious about this, take a cybersecurity class. There are plenty available but how a computer works, software and hardware alike, is precisely what makes them simultaneously powerful and also dangerous. There are plenty of ways to break security (e.g. return oriented programing), plenty of ways that practically impossible (e.g. encryption) due to the very nature of computers (i.e. computational complexity) which IMHO makes this one of the most fascinating topic. Ask yourself come the credit card in your pocket (costing few bucks to make) can’t be cracked by the largest super computers (costing billions) on Earth?

TL;DR: no offense but you don’t seem to be ready for the answer without getting the basics first.

To have the most secure machine possible, you might need a hardened kernel but you absolutely need to have SELinux (or equivalent) rules set up.

The easiest way to have a go at this would be to install OpenSuSE (any version will do, they all ship with SELinux ootb) and follow guides on how to setup SELinux permissions.

Nothin, just install your favourite distro and don’t run random command/scripts/binaries you found on the internet