If someone was trying to hack into my OS whereby they could put malicious code there, which Linux OS would best withstand this kind of attack?

I know the router, firewall, switch, etc will play a prominent role for defense, but that's irrelevant for my question. My question is simply is there a stronger OS that would be more resistant to being hacked 'based 100% on the strength of the code (or infrastructure) of the OS'? For example, Kali Linux, or CentOS, would be harder to put malicious code on versus Debian.

It also doesn't matter how difficult the OS would be to use.

closed as primarily opinion-based by muru, mosvy, doneal24, Philippos, Michael Homer Jul 19 at 3:31

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I doubt there will be significant differences between distributions if you are only interested in the specific scenario of an attacker trying to insert malicious code. The most secure will almost always simply be the one which is updated most regularly, so something like Arch or Fedora. – terdon Jul 17 at 11:30
  • Where would ubuntu rank? – themira Jul 17 at 11:31
  • 1
    Relatively high if you keep it up to date. But really, the differences will be minimal on any updated system. – terdon Jul 17 at 11:33
  • It also doesn't matter how difficult the OS would be to use. Yes it does. Otherwise the safest OS is any OS in a switched off computer, with zero usability. So, you want some usability. – xenoid Jul 17 at 14:50

The safest Linux-based distributions are those which limit the users’ ability to change them, and which isolate applications from each other. One good example is Fedora Silverblue: the base operating system is immutable, and applications are provided using container-style techniques. A recent blog post on the topic describes the advantages in a little more detail. (Before someone points this out, containers don’t provide security, the immutable base does; containers contribute to security, and more importantly, they enable fast updates to individual applications.)

Qubes OS takes this further still, by running applications inside different VMs.

Operating systems which can’t be changed offer limited options for malicious code to take hold.

  • Thx. Does Qubes, by default, come with a browser? Asking b/c I thought I once downloaded an upper-tier OS and I couldn't figure out how to open a browser and get going. – themira Jul 17 at 11:58
  • Is there much truth to the following? "You can have the world's best firewall, but if the OS is weak or not very secure, the firewall can not save the OS from itself". – themira Jul 17 at 12:19
  • 1
    Qubes does include a browser, yes (Firefox). And yes, firewalls don’t deal with all threat scenarios, so they don’t protect the OS from itself; in particular they don’t protect from many browser-based attacks. – Stephen Kitt Jul 17 at 12:22
  • If my FB account has malware in it, when I log in, can it hijack my browser and give remote access to my computer when I'm running linux OS? Would Qubes offer better protection from something like this? Thank you. – themira Jul 17 at 12:41
  • Yes, your browser can be hijacked to provide remote access (as far as I’m aware this is mostly theoretical; I’m not aware of large-scale attacks of this nature). Qubes offers better protection against attacks of this sort: the remote access would only extend as far as the hijacked “domain” (in Qubes terminology; that’s the VM running your browser), and if you limited its access to your data, your data would be safe. Recovery would involve nuking the affected VM, not the complete operating system. – Stephen Kitt Jul 17 at 12:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.