It's kind of funny that Krebs doesn't mention the other obvious "one weird trick", which has been around for decades now: do not run your critical systems on Windows.
https://en.wikipedia.org/wiki/Linux.Encoder
Or MacOS:
https://en.wikipedia.org/wiki/MacOS_malware#Ransomware
The reality is that this problem is 90% systemic/organizational and 10% technological. You can definitely run only Linux, make the same mistakes as these Windows shops made, and get destroyed by ransomware.
A lot of this problem is getting the fundamentals wrong (flat network layout/design, no/bad backup strategy, shared credentials across different classes of equipment, and too liberal inter-access). Much of which is wrong for organizational convenience and sometimes cost savings.
I can look at an org without even knowing what OS they run and tell them if they're vulnerable or not, because the assumption you must make is that entry will occur at some point, and then evaluate how or to what extent it can propagate and what the costs/consequences will be.
Ransomware will continue until organizations and their management are held accountable for their own incompetence/apathy/cost-cutting, that let the ransomware cripple the company. If I was on a company board I'd ask for the CEOs job if backups didn't exist or company operations shut down for multiple days/weeks, but that isn't happening.
I think that's an extremely poor assumption. How many people on HN run containers with "docker run"? How many of those users actually went and personally audited those containers before doing a docker run vs. just trusting someone else checked first? I can tell you first hand I've seen dozens of customers do a docker run with a public image on a system attached to an internal network without giving it a second thought.
I'd hazard a guess that a far LESS percentage of linux users do so, than Windows users who would open an exe if their browser told them to and fall for other types of ransomware.
curl https://raw.github.com/innocent/script.sh | sudo sh
It's been a long time since "using linux" meant you're "smart enough to..." Probably around the time corporate IT departments everywhere realized Linux on x86 was cheaper than Solaris and could still get the job done.
The vast majority of these are going to be Windows executables and Windows-specific things. Your random malicious website is much more likely to target Windows desktop users than Linux desktop users.
If a company's Linux boxes mostly run production servers that are generally stateless and/or covered by a comprehensive disaster recovery policy, then there's a good chance that their response to your ransomware attack will be to laugh in your face and push the "recover" button.
On the other hand, there's a decent chance that at least some of the company's Windows computers contain some critical spreadsheet that holds together some essential business process and isn't being regularly backed up.
The thing is, that balance only works as long as there aren't a whole lot of organizations running all Linux. Because, if there were, then you'd start to see more of those critical irreplaceable files living on people's Linux desktops.
On Windows, there's typically a human interacting with it. That's a big part of your attack vector; you're trying to get them to download and run a file. Once they do that, it's able to interact directly with the OS. And you've got a lot more incentive to stick around once you get in, because typical users aren't going to notice if the computer's chugging a bit harder due to running a botnet or encrypting the whole hard drive.
On a server, though, everything's probably pretty closed down. And there's generally no human to let you in. So instead of attacking the OS itself, you attack the services running on it. And if you do get into one, there's likely no need to go after the OS from there, because you're already in the memory space of the app, which is where all the goodies lie. And you're also not likely to stick around and waste CPU resources on running a botnet or encrypting the drive, because any halfway competent ops team is going to have monitoring in place, and will notice and investigate the anomalous spike in activity.
Which takes us back to my point: correlation is not causation. Relative compromise rates for the two OSes may well have nothing at all to do with the actual OS. The real thing that's being attacked is the class of computer: viruses want to go after user workstations, not servers.
I have often read about how secure OpenBSD is, but I've also thought that you give up a lot of convenience in using it. I don't think my circumstances would justify switching to OpenBSD.