Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

41–50 of 584 posts

Re: Omarchy: Any User Process Can Escalate to Root

#41

Post by 12985-1286 »

ecshafer wrote: post #7
phoronixrly wrote: post #6

Earlier quoted context omitted.

Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..

Come on. I am sure you don’t like DHH. But he’s always taken security seriously in Rails.

Shopify forced him to be a vibe coder now. Omarchy is a vibe coding distribution.

In the AI world, security issues are just another marketing opportunity.

EDIT: Downvote all you want. He was anti-AI, got a board seat at Shopify and then became an AI influencer. Now additional money is rolling in to Omarchy from Lütke and Steinberger.

Re: Omarchy: Any User Process Can Escalate to Root

#42

Post by quadrifoliate »

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

[flagged]

Re: Omarchy: Any User Process Can Escalate to Root

#43

Post by sva_ »

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

I think this is more about the UI, rather than the install. I haven't tried it myself though.

I think nowadays using quickshell anyone who is so inclined can vibecode their own UI though. I recently made the switch to Wayland/hyprland and rebuilt my polybar on quickshell, even adding widgets that allow getting system info/fine grained system control (interactive Bluetooth, WiFi, Volume, Brightness etc).

Re: Omarchy: Any User Process Can Escalate to Root

#44

Post by lobofta »

qweqwe14 wrote: post #12

OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…

Because it looks cool and DHH makes a lot noises that sounds like you should listen to him.

Re: Omarchy: Any User Process Can Escalate to Root

#45

Post by k_roy »

pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

Default configuration or not, I also imagine the first thing people using docker do is to add themselves to the docker group via sudo.

If you are security-conscious, you shouldn’t be using docker anyway.

Re: Omarchy: Any User Process Can Escalate to Root

#47

Post by amluto »

mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works.

I’m sorry, what? MacOS’s desktop sandboxing is pathetic. Sure, it kind of sort of tries to prevent an application from rummaging until you give it permission. And that permission is hilariously coarse grained, and it gets regularly broken anyway. (Seriously, read about TCC breaks. They’re not little implementation errors — they’re giant gaping holes in the whole concept.) The entitlement mechanism basically serves to help Apple restrict what developers can do without meaningful protecting Apple’s users.

If you think that it protects you when your Mac prompts to ask whether Terminal.app may access Documents, you are welcome to enjoy your warm fuzzy feelings.

> Unfortunately implementing an Apple style architecture on Linux would be very difficult.

Why would it be difficult? I think that mostly it would reveal to whomever implemented it how useless it is.

If you mean sandbox-exec, you can do this on Linux, too. And the Linux mechanisms are not considered deprecated and undocumented, whereas Apple steadfastly refuses admit that sandbox-exec is a real mechanism.

Re: Omarchy: Any User Process Can Escalate to Root

#48

Post by concinds »

A few days ago someone found they were flowing USB descriptors straight into the shell.

https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...

Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Re: Omarchy: Any User Process Can Escalate to Root

#50

Post by iririririr »

qweqwe14 wrote: post #26
pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

Because it's convenient, and the security of this doesn't matter for desktop usage.

lol. people will vote you and not realize the irony.

just look at all the comments "this is a fair and common mistake" that are not being ironic.

Post reply on HN