The Short Answer, and Who It Is Short For

The claim that hackers prefer Linux is repeated often enough to have stopped meaning anything. It is usually offered as a compliment to Linux, occasionally as an insult to everyone else, and almost never with enough specificity to be checked. Two words are doing unexamined work in it: hackers, which covers a dozen trades with incompatible requirements, and prefer, which hides whether the preference is about capability, cost, habit or identity.

This deep dive treats the claim as a technical proposition rather than a tribal one. Where Linux is genuinely the better tool, the reason is stated in terms someone could test. Where it is not — and there are several such places, some of them large — that is stated with the same specificity. The final volume is devoted entirely to the cases where the answer is Windows or macOS, because an argument with no limits section is advertising.

1.1 Naming the population

“Hacker” is used here in its older and more useful sense: someone whose work requires understanding a system below the level at which it is normally presented. That population is not homogeneous, and the differences between its parts predict the platform choice better than the label does.

• Vulnerability researchers and exploit developers need source, symbols, debuggers, and the ability to instrument a running system.
• Network and wireless practitioners need raw frame access, injection, and control of the radio.
• Red teamers and penetration testers need a large, current tool inventory and, increasingly, need to operate against Windows estates.
• Malware analysts and reverse engineers need isolation, snapshotting, and disassemblers — and mostly analyse Windows binaries.
• Digital forensics examiners need court-defensible tooling, which in practice means specific commercial products.
• Systems and site-reliability engineers need to work on the machines they operate, which are overwhelmingly Linux servers.
• Embedded, firmware and hardware people need cross-compilers, serial consoles, JTAG and USB access.
• Kernel and low-level developers need the source of the thing they are changing.

Four of those groups have an obvious structural reason to run Linux. Two have a structural reason to run Windows. One — Apple platform work, not listed above precisely because it never had a choice — is legally and technically bound to macOS. That distribution of answers is the honest shape of the question, and it disappears entirely when the population is flattened into “hackers”.

1.2 The short answer

For the groups where Linux does win, five properties account for nearly all of it. Each is developed in later volumes; each is stated here in a form that can be argued with.

Transparency. The source of the kernel and of essentially every component above it is available, and the licence guarantees it stays available. This is not an abstract virtue: it means a bug can be read rather than guessed at, a behaviour can be traced to the line that causes it, and a patched kernel can be built and booted the same afternoon. Kali’s own documentation notes that its kernel carries patches for wireless injection — a modification that is simply not available as an option on a closed system.

Control. The running system is inspectable and modifiable by its owner. /proc and /sys expose kernel and process state as readable files; ptrace, perf and eBPF allow a process, a syscall path or a kernel function to be observed live; a network interface can be put into a different mode with one command. Nothing here requires a vendor’s permission or a signed agent.

Tooling. The great majority of open security, networking and development tooling targets Linux first, is packaged by the distributions, and is installable in one command. Kali alone ships, by its own description, several hundred such tools.

The shell as a first-class interface. Not merely present, but the primary interface, with every tool designed to be composed with the others through text streams. This is the property that most reliably converts a manual investigation into a repeatable one.

Package ecosystems. Software installation is a solved, scriptable, auditable problem. A tool, its dependencies, and its updates come from a maintained archive rather than from downloaded installers.

1.3 What the numbers actually say

Two quantitative points are worth putting on the record early, because both are routinely misused.

The Stack Overflow Developer Survey for 2025 — drawing more than 49,000 responses across 177 countries, with multiple selections permitted, so the figures total well above 100% — reported professional-use shares of roughly 49.5% Windows, 32.9% macOS, 27.7% Ubuntu and 16.8% WSL, with other Linux distributions reported separately. (The survey’s own technology page could not be retrieved while preparing this writeup; these figures come from secondary summaries citing it and should be treated as approximately correct rather than exact.) Two conclusions follow. Linux is a major professional development platform, not a fringe one. And it is not the majority platform even among developers — Windows is, and macOS is close behind Ubuntu.

The second number is the general desktop market. StatCounter’s worldwide desktop figures in mid-2026 put Linux at roughly 4%, against a large majority for Windows — with the significant methodology caveat that its “Unknown” category had climbed to nearly 19%, which makes small shares unreliable. Linux is a minority desktop operating system by an enormous margin. Any argument that begins by denying this is not worth continuing.

Both facts can be true at once: Linux is a minority desktop and a dominant server, development and security-tooling platform. The preference under examination is occupational, not general.

1.4 What “prefer” is doing

It is worth separating four different claims that the word conflates.

1. Capability — there are tasks that can only be done, or can only be done well, on Linux. True, and specifiable: raw 802.11 work, kernel instrumentation, container internals.
2. Convenience — the same task is faster or cheaper on Linux. Often true, and the reason is usually packaging rather than any deep property.
3. Parity with the target — the systems being worked on are Linux, so the workstation may as well be. True for server, cloud and embedded work; false for enterprise-endpoint and Apple work.
4. Identity — running Linux signals membership. Real, and not worthless, but not evidence of anything technical, and it is where most of the weaker versions of this argument live.

The volumes that follow deal with the first three and try to leave the fourth alone.

1.5 The test applied throughout

Each claim made for Linux in this dive is held to one standard: could a practitioner check it on a machine in front of them within an hour? “The kernel is open” passes — the source can be downloaded. “A wireless interface can be put into monitor mode” passes — iw list prints the supported modes, and on the machine used to prepare this writeup that list includes monitor. “Linux is more secure” does not pass as stated and is not made here; the fourth volume examines the specific version of that claim which is testable, and the several well-documented occasions on which it failed.