It’s just gonna be part of security audit theater. “Prove your organization is [x] compliant.”

IT: you have to use windows so we can add your computer to intune

Developer: no

IT: Microsoft pls

Microsoft: Ok it’s on Linux now, that’ll be another seat license for clamav wrapped in our logo or something

IT: omg we’re so secure

Auditing company: omg they’re so secure

Wait til you learn about EDR like crowd strike

Yeah but clamav doesn’t have “a centralized dashboard with mdm and intune integration” e.g. a spreadsheet that says when everyone’s last scan was and that their definitions are up to date so the security theater can exist. Not to worry, more likely than not this is just built on a mountain of open source software like clamav that’s probably MIT licensed so MS can slap their logo on it and charge for it

Complicate requirement are kind of out of date. They keep adding requirements to them but then don't often take them away. So if a requiment made sense 20 years ago it's still there even though there are better strategies to protect your environment.

You could skip a requiment if you can establish a compensatinh control and show that the threat the requirements is intended to address is addressed. For example skipping antivirus by reimagining the devices every morning, this is an absurd example but would work.

ClamAV is shit, and I’ve been using it on my machine for years

It's mostly Windows of course. But some people in those companies may prefer to use Linux, and this gives a them a higher chance of being allowed to do so. I for one am running Linux in a company that's increasingly pushing for Microsoft stuff.

I unironically use PowerShell on Linux. It's the only shell with sensible key bindings.

Ah right. Forgot about that cancer. If we are at it, also Visual Studio Code (or VSCode for short) too.

No, Linux can handle that. :-)

I know a grad student that does. Compiles it from source themself.

I think that depends entirely on whether opt-in is legally required in a given jurisdiction but they’ll certainly try and use every dark pattern in their arsenal to do so.

It's basically chromium running the web version, but it appears as though it's a stand alone app. At least that's how it worked for the couple of Teams for Linux and Outlook for Linux apps I tried. I used this as part of a contract gig for about 2 years on Ubuntu machine.

Not really imo

No, Red Hat for the most part is not in the security game. There is OpenSCAP. Red Hat OpenShift does have Advanced Cluster Security available. But generally no Red Hat doesn't make security products like that. I guess maybe the closest would be using Satellite to manage clients and see their compliance. I don't know if Satellite can measure OpenSCAP compliance... Yes, there is a lot of security built in, but no they don't really do many explicitly security products.