Linux solved this problem almost twenty years ago. You have a package manager that does not contain malware and does contain 95% of the software any user would install on a regular basis, and you make the process of installing software outside of the package manager possible but not trivial. You download a binary and it doesn't have the execute bit set, and you don't get any kind of friendly thing that pops up to ask you if you want to set it. So the sort of person who can't distinguish between legitimate software and malware also can't figure out how to install the malware, but you don't prevent people who know what they're doing from doing what they want.
The problem with Windows is that it has no package manager, so the default method of installing legitimate software is identical to the method of installing malware. The problem with Android is that the malware is in the app store. All you need is a known-good repository where you can get almost everything safely and people can spend most of their time. You don't then need to build a prison around it and trap everyone inside because most people will want to stay in the safe place. The people who want to (and can figure out how to) wander outside are the people who know what they're doing, and know to be suspicious of the things that conspicuously haven't been vetted by anyone else.
If Linux were to get as popular as Windows, the problem is going to way worse.
Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows.
> If Linux were to get as popular as Windows, the problem is going to way worse.
Everybody says this but it doesn't make any sense. Are the repositories going to get more malware when there are more people and funding available to notice and report it?
> Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows.
All the more reason why it wouldn't happen on Linux. Nobody really pirates LibreOffice or gcc.
The problem with Windows is that it has no package manager, so the default method of installing legitimate software is identical to the method of installing malware. The problem with Android is that the malware is in the app store. All you need is a known-good repository where you can get almost everything safely and people can spend most of their time. You don't then need to build a prison around it and trap everyone inside because most people will want to stay in the safe place. The people who want to (and can figure out how to) wander outside are the people who know what they're doing, and know to be suspicious of the things that conspicuously haven't been vetted by anyone else.