Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

141–150 of 584 posts

Re: Omarchy: Any User Process Can Escalate to Root

#141

Post by rs_rs_rs_rs_rs »

dzonga wrote: post #111
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

the unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype. the tech might gets fixed later.

[flagged]

Re: Omarchy: Any User Process Can Escalate to Root

#142

Post by KetoManx64 »

qweqwe14 wrote: post #12

OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…

The point is that there are millions of people out there that are curious about Linux but are put off by anything command line. Distro like this, especially Quatro which has a big focus on agents, makes it more inviting and gives people an instant path to get help/have their problems solved without them having to search archaic error messages

Re: Omarchy: Any User Process Can Escalate to Root

#143

Post by jorvi »

lrvick wrote: post #87
tomrod wrote: post #78

Earlier quoted context omitted.

What? Why is sudo security theater?

Because it is trivial for unprivileged malware to phish the password and escalate to root. No production system should ever ship with sudo.

You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas.

No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage.

Re: Omarchy: Any User Process Can Escalate to Root

#144

Post by jbstack »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

There's definitely appeal in key-driven window managers in general. Projects like i3 and Niri are popular. But you can get that with any Linux distro (albeit not many have it set up that way by default). You don't generally choose a distro just for whatever DE/WM it happens to start with.

Re: Omarchy: Any User Process Can Escalate to Root

#145

Post by rfgplk »

I've already stated this on the last Omarchy thread, the way DHH is implementing it is highly irresponsible and insecure. Half of his "distro" are essentially shell scripts where it's extremely easy to create accidental security holes. Considering that probably half of his code would need something like setuid/execute bits set in order to avoid configuration spaghetti, I'd imagine that there are _hundreds_ of vulnerabilities in there. If you think about it logically, just the desktop environment (note that I have no idea if he coded his own or is using an existing one) needs access to input the graphics driver the netstack all of which require priviledges of some kind.

Re: Omarchy: Any User Process Can Escalate to Root

#146

Post by lrvick »

jorvi wrote: post #143
lrvick wrote: post #87

Earlier quoted context omitted.

Because it is trivial for unprivileged malware to phish the password and escalate to root. No production system should ever ship with sudo.

You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas. No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage.

No popular Linux desktop, I would grant you. I use QubesOS and my own distro, stagex.

Re: Omarchy: Any User Process Can Escalate to Root

#147

Post by mosura »

mike_hearn wrote: post #114
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

"Someone" didn't find that, AI found it. So it's not clear what your point is about vibe coding. Would humans have noticed this problem, especially given that it's not remotely exploitable? (you have to plug in a malicious USB device).

The fact comments like this get downvoted because what they say is inconvenient is one of the major signs AI has fundamentally broken HN.

It was already hard to have technical conversations in public, now there is a contingent determined to make it utterly impossible, and they are succeeding.

Re: Omarchy: Any User Process Can Escalate to Root

#148

Post by urams »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

> I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it.

Whoa! You have to _learn_ something to use it well? Yikes. Not for me.

Re: Omarchy: Any User Process Can Escalate to Root

#149

Post by bigyabai »

mike_hearn wrote: post #140
bigyabai wrote: post #131

Earlier quoted context omitted.

[flagged]

Bubblewrap isn't a sandboxing architecture, so no. Go look at how Apple designed the macOS/iOS security system and you'll see that a Bubblewrap like tool is only. small portion of it.

Linux in-general is a small portion of the Darwin architecture. One is a monolithic kernel, the other has microkernel IPC security to consider.

Are there any glaring limitations in Bubblewrap you'd like to point out, or are we having the Tannenbaum argument all over again?

Post reply on HN