Linux doesn't have a tradition of downloading and installing random software, though, so there would be a bigger behavioral hurdle to get users to install the malware.

I think the behavioral differences are almost entirely because current Linux userbase is mostly people who have self-selected Linux over the default OS their laptop came with.

(And I still see a fair number of Linux install scripts that look like "curl ... | sh")

Linux has a nice repository, with nearly all the software you need available, signed with known good keys.

Linux does not have "your mouse pointer moved. Are you sure you want to proceed?" dialogs.

Linux has a manageable set of file permissions, including the "execute" permission being set by the users, not by any random server from where you download your file. (Yep, there was some regression here lately.)

And, of course, Linux is actually hard to compromise without user intervention. Differently from Windows.

If you really believe it's the users fault, you have your head deep buried on the sand.

No it can be worse than that the install instructions say:

  `curl http://example.com/foo/install.sh | sudo sh`

or if it does request the script by https there is a fair chance that the install script itself will then download by http.

Equally bad is adding a new key to apt/(other package manager) and add a new source then apt-get install (which definitely runs as root).

I blame that on overconfident MacOS X developers not understanding best practices for security.

The tradition was there, and it sucked.

Hunting the Internet to track down random dependencies, watching freshmeat.net every day for new releases, and fighting with all of the different build systems was what I did every day ca. 1997.

Yeah. The key word here is "was".

In other words, installing (and upgrading!) software in Windows has not made much progress since 1997. I blame MS's decision "oh sure, you can integrate your program into Windows Update, it will only cost you $BigBucks per year."

No, you just have to install from source if you want something that your package manager doesn't provide and then hope you can actually get all the dependencies compiled.