I’m not talking definition detections or clamAV (which is shit and has long had the lowest scores in comparative testing, it’s for use on email servers to prevent known old malware from being passed around or stored on a file share, that’s it, it’s not end-point security, it won’t even try to stop the most amateur hacker out there to say nothing of nation-state actors).

I’m talking real endpoint security that consumers can access without slapping down $400 a year for a corporate security license from Palantir (NSA in a trenchcoat warning) for 8 machines when only half that is needed.

I’m talking access controls, comprehensive exploit prevention, attack chain interruption and mitigation, scripting control, prompt to allow execution warnings, IPS/IDS in a software package for the desktop.

“Just do this deranged thing where you totally lock your Linux machine down and break tons of things you need and then spend dozens of hours every 3 months fixing it because an update badly broke your whole OS again” yeah no thanks I have a life and troubleshooting my own machine due to trouble I made isn’t part of it. On Windows machines I can click and deploy after a short audit period software that does all I outlined, it’s easy, it works, it comes with default allowlists of essential OS executables and libraries so it doesn’t break the OS itself and the most trouble I have is needing to occasionally click a prompt to allow or block something which takes all of a few seconds, maybe a few minutes if I need to look up what’s going on. And I can find free, pay once, and cheap annual subscriptions for under $200 annual from multiple providers for at least parts if not the whole thing. It’s frustrating!

Due to advances in AI driven exploit finding the cost for zero-days is due to plummet and the access to such abilities with some money has come within the reach of even small criminal/hacker groups. So saying zero days are expensive and unlikely is a variant of the obscurity argument and not valid to rebut the points nor increasing relevant with AI driven exploit fears which may allow mass campaigns with brand new zero days for cheap.

And you can hmm and haw about security through obscurity but that doesn’t really help your argument or my situation and we both know it.

-Signed someone who likes Linux and desperately wants the same security options and capabilities as a properly configured Windows machine running properly configured security software (you can’t do it on Linux if it doesn’t exist and that’s a market size problem to some degree). I fucking hate Windows and I hate Micro$lop even more but I’m not going to bury my head in the sand and pretend this isn’t a real problem.

P.S. Please prove me wrong. Point me to software that does most of what I asked, isn’t $60 per machine annual (or a minimum purchase of $300 of licenses due to requiring at least 10 machines), meets the usability requirements of being relatively easy to run and maintain (security that’s relatively easy is security that holds up over time, security that’s hard gets turned off, turned down, ignored, or deferred for ease of use). I desperately want this and I will retract my statements and sing your praises. (No Bitdefender for Linux doesn’t count, they’re an NSA/eyes vacuum and really not a hard-configurator, access control/IPS centered solution anyways. Anything that sends files or file hashes to remote servers whose developers are based in eyes countries is an NSA/eyes vacuum that feeds them data on you.)

P.P.S. I already have network edge defenses and firewalls/IPS/IDS set-up but that’s not really enough by a long-shot as I’m not talking about the low-hanging fruit of known cryptolocker campaigns or known cobaltstrike beaconing but the real big fish bad threat actors who pull out something never before seen and pair it with at least one 0-day exploit.