Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

51–60 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#51

Post by skydhash »

dpkirchner wrote: post #28
gruez wrote: post #19

Earlier quoted context omitted.

>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.

The methods are described on the official docker website, not just random blogs or SO pages. There are caveats about security, of course, but it's not truly discouraged.

I think there are notes that warn you about the consequences. And they have been written with sys admin in mind which knows about user groups and security.

Re: Omarchy: Any User Process Can Escalate to Root

#52

Post by pibaker »

k_roy wrote: post #45
pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

Default configuration or not, I also imagine the first thing people using docker do is to add themselves to the docker group via sudo. If you are security-conscious, you shouldn’t be using docker anyway.

If you are adding yourself to the docker group, you have presumably read the documentation and its warnings. Does an Omarchy user know the distro has made the decision on their behave?

TFA spells out why this is wrong better than I could.

> There is another important aspect of this configuration. It was opt-out, not opt-in. A user did not have to actually use Docker. The security tradeoff was made for them, applied to the default account, and the tradeoff was not explained to the user.

> Security-sensitive defaults matter precisely because many users reasonably assume that the operating system defaults to secure and will inform or prompt them to opt-in to less secure settings.

Re: Omarchy: Any User Process Can Escalate to Root

#53

Post by inigyou »

k_roy wrote: post #45
pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

Default configuration or not, I also imagine the first thing people using docker do is to add themselves to the docker group via sudo. If you are security-conscious, you shouldn’t be using docker anyway.

I have passwordless sudo anyway. XKCD knows why the password is pointless.

Re: Omarchy: Any User Process Can Escalate to Root

#54

Post by inigyou »

lobofta wrote: post #44
qweqwe14 wrote: post #12

OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…

Because it looks cool and DHH makes a lot noises that sounds like you should listen to him.

And he politically aligns with a lot of people.

Re: Omarchy: Any User Process Can Escalate to Root

#55

Post by esskay »

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

Add that annoying theo guy to that list. Cant stand these people, they confidently push out videos like they're experts, a week later it turns out whatever they were talking about was total crap and they've already abandoned it - case in point OpenClaw. Look at the mess of videos those named above put out about it, not a single one uses it anymore.

Re: Omarchy: Any User Process Can Escalate to Root

#56

Post by skydhash »

dimitarbogdanov wrote: post #39
delduca wrote: post #10

Is it not better to run a VM just for Docker, like we have to do on macOS?

Damn, I did not know you need a VM for Docker on macOS. That's kind of ironic, isn't it XD Every day I wake up and thank the universe for MS making WSL2

Isn’t WSL2 vm based?

Re: Omarchy: Any User Process Can Escalate to Root

#57

Post by esskay »

pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

[flagged]

Re: Omarchy: Any User Process Can Escalate to Root

#59

Post by rramon »

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

Omarchy imo is best for agent maxxing Mac power users who aren't locked into Apples proprietary apps like Final Cut, audio production software or Adobe and Affinity, so maybe not so great for designers and photographers as the main system.

Re: Omarchy: Any User Process Can Escalate to Root

#60

Post by gruez »

bardsore wrote: post #27
gruez wrote: post #19

Earlier quoted context omitted.

>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.

Adding your user to the docker group is in the official Docker install instructions, I wouldn't call that "random copy paste guides".

You mean the optional post install instructions, which is a separate page from the main install instructions, and contains a giant warning about the security implications?

https://docs.docker.com/engine/install/linux-postinstall

If the official sudo project had a guide on how to disable passwords, that shouldn't be taken as endorsement of having that as a default config.

Post reply on HN