241–250 of 590 posts
It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
Earlier quoted context omitted.
[flagged]
Could you point to things that are not glaring security vulnerabilities that are ridiculed in the same way?
Earlier quoted context omitted.
> The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit. If you say no, you can’t use less or cat to read your documents. If you say yes then you are completely unprotected, forever, from anything you might run from the terminal. > It also needs pervasive kernel e…
The right right question would be: why aren't we enforcing a document to be self-contained? Why are documents agents? Why can any document access anything or indeed, do anything? That's not a document, that's a program!
Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…
Its opposite. Windows and MacOS lacks proper sandboxing. While openbsd has pinsyscalls and linux has seccomp-bpf. Windows and MacOS only have filesystem and worse version of user namespace sandboxes, anything else and you need to write a kernel extension or rely on a hypervisor. > Unfortunately implementing an Apple style architecture on Linux would be very difficult. The apple apps kind of thing already exists and i…
Flatpak is just a cheap container copy. Can't do anything beyond what cgroups and things like apparmor and selinux can do, and uses a runtime to do soft higher-level policy functions that translate down to the same primitives. If anything, it's a great bundler, but doesn't do anything new policy-wise.
So, can you get the macOS-level capabilities (both low-level and higher abstractions)? On Linux, yes, but they don't exist yet. On Windows: technically possible, but since that would break most GUI workflow it's not likely that anyone is going to bother, and you're going to have a hard time recompiling windows yourself to make that happen.
Earlier quoted context omitted.
I don't care what he's doing, I care about what he is.
He's a person, just like you are. Let him know then, he has an email and you can message him publicly on X.
Earlier quoted context omitted.
Come on. I am sure you don’t like DHH. But he’s always taken security seriously in Rails.
Shopify forced him to be a vibe coder now. Omarchy is a vibe coding distribution. In the AI world, security issues are just another marketing opportunity. EDIT: Downvote all you want. He was anti-AI, got a board seat at Shopify and then became an AI influencer. Now additional money is rolling in to Omarchy from Lütke and Steinberger.
Earlier quoted context omitted.
It is one thing to do things the risky way on your own system and another thing to ship an unsafe and unconventional default to your users.
For a single user, opinionated, modern, developer focussed OS, this is completely and utterly on par. Using docker as a developer without this is just plain annoying.
Earlier quoted context omitted.
[flagged]
> In a different way you can see this in this thread where instead of discussing why Omarchy has the bug There's nothing interesting to discuss. Rootless OCI-compliant containers exist, and Omarchy ignored them. The "convenience" of the solution they chose simultaneously opens an enormous attack surface that the maintainers didn't consider. This is why I don't believe the "give me a macOS distro" people - even Apple…
Why Omarchy chose to ignore all the rootless OCI-compliant containers; and also why docker itself isn't rootless yet is a pretty interesting thing to discuss. I'm not aware of the specifics being a Mac user myself, but others in the thread (e.g. here https://news.ycombinator.com/item?id=49500186) say that podman still doesn't work 1:1 with docker exactly.
If you disagree, that's a reasonable thing to discuss; but otherwise just saying "ha ha just use the rootless thing" is missing the point.