Eirikr70 But Linux is the operating system of the vast majority of the corporate servers.
https://privsec.dev/posts/linux/linux-insecurities/#why-is-linux-used-on-servers-if-it-is-so-insecure
On servers, while most of the problems referenced in the article still exist, they are somewhat less problematic.
On Desktop Linux, GUI applications run under your user, and thus have access to all of your files in /home. This is in contrast to how system daemons typically run on servers, where they have their own group and user. For example, NGINX will run under nginx:nginx on Red Hat distributions, or www-data:www-data on Debian based ones. Discretionary Access Control does help with filesystem access control for server processes, but is useless for desktop applications.
Another thing to keep in mind is that Mandatory Access Control is also somewhat effective on servers, as commonly run system daemons are confined. In contrast, on desktop, there is virtually no AppArmor profile to confine even regularly used apps like Chrome or Firefox, let alone less common ones. On SELinux systems, these apps run in the UNCONFINED SELinux domain.
Linux servers are lighter than Desktop Linux systems by orders of magnitude, without hundreds of packages and dozens of system daemons running like X11, audio servers, printing stack, and so on. Thus, the attack surface is much smaller.
argante I'll defend Linux. Blaming Linux is a bit like a chef trying to make a pizza. He has the ingredients: flour, yeast, etc. Let's say Linux is our flour. The pizza failed, everyone complains it's inedible. And what does the chef say? He'll claim it's not his fault... it's the flour's fault, because he won't admit he messed up.
In the case of OSs like GrapheneOS, they do everything they can to make the pizza nice and healthy. The pizza is still objectively limited because the flour has been demonstrated to be unhealthy. That’s why GrapheneOS is trying to move away from that type of flour