Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

171–180 of 584 posts

Re: Omarchy: Any User Process Can Escalate to Root

#171

Post by lrvick »

mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works.

As a QubesOS user, I beg to differ. Just because most Linux distros are negligent with sandboxing does not mean all of them are.

Re: Omarchy: Any User Process Can Escalate to Root

#172

Post by fhn »

normie3000 wrote: post #135
AshamedCaptain wrote: post #107

Earlier quoted context omitted.

While I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is free . Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.

Isn't Windows also basically free? Every laptop I buy has a Windows licence stuck to the bottom of it.

which means you paid for it. just because it comes bundled doesn't mean always it's free. https://en.refund4freedom.org/

Re: Omarchy: Any User Process Can Escalate to Root

#173

Post by StrLght »

exitb wrote: post #15

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

Exactly! I was also surprised by this — that's a sensible default for many people.

However, I agree that it should be opt-in. Docs should be more explicit about that too, they should warn users about risks of going with that option. That excerpt mentioned in the article was rather misleading.

Re: Omarchy: Any User Process Can Escalate to Root

#174

Post by Aurornis »

teekert wrote: post #157
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

> What is different here?

I don’t understand how this is a question.

What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be.

You can choose to configure your installs this way if you choose to do so. It should not come this way quietly by default.

Re: Omarchy: Any User Process Can Escalate to Root

#175

Post by vga1 »

awesan wrote: post #103
onesandofgrain wrote: post #90

Earlier quoted context omitted.

This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby

Omarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.

Even worse. They don't even have AI review them. I fed the commits that introduced the problem to a few frontier models and they saw several problems, including the aforementioned security problem. Even Mistral saw it. I did have to instruct all models to look for security problems, though, but still.

It's not that we shouldn't use vibecoded distros. It's that we shouldn't use badly vibecoded distros with shitty or non-existent processes.

Re: Omarchy: Any User Process Can Escalate to Root

#177

Post by ludocode »

teekert wrote: post #157
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

> I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year.

You may do that, but I don't. I always use sudo to manage the few docker containers I need, and I prefer podman where possible specifically because I can run it rootless.

If you want to give your user passwordless root for convenience, go ahead, but that should never be the default.

Re: Omarchy: Any User Process Can Escalate to Root

#178

Post by happytoexplain »

teekert wrote: post #157
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

>Everybody knows this.

I didn't know this.

Re: Omarchy: Any User Process Can Escalate to Root

#179

Post by markstos »

teekert wrote: post #157
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

A distro should be secure-by-default. Omarchy’s design here was insecure by default while the docs have the impression that Docker might be running rootless. Pairing insecure defaults with docs that claim better security is bad.

Re: Omarchy: Any User Process Can Escalate to Root

#180

Post by LinXitoW »

Aurornis wrote: post #174
teekert wrote: post #157

Earlier quoted context omitted.

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

> What is different here? I don’t understand how this is a question. What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be. You can choose to configure your installs this way if you choose to do so. It should not come this wa…

It does warn you. It's an opinionated Linux for a modern developer/user. This modification absolutely makes sense in that context.
Post reply on HN