Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

291–300 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#291

Post by thegrim33 »

awesan wrote: post #103
onesandofgrain wrote: post #90

Earlier quoted context omitted.

This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby

Omarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.

On Lex Fridman recently DHH was enthusiastically bragging about how he was letting AI generate C++ that he intentionally wasn't even looking at, he was treating it as a pure black box and just submitting the output.

Re: Omarchy: Any User Process Can Escalate to Root

#292

Post by PuercoPop »

drnick1 wrote: post #287
teekert wrote: post #157

Earlier quoted context omitted.

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

> I always make my user part of the docker group I don't, and I migrated to Podman because Docker is poorly designed and full of footguns. For example, it it will silently overwrite iptables rules and punch holes in your firewall.

Indeed. Podman works great. And kube play unifies container orchestration by using k8s manifests for local orchestration instead of a separate DSL like docker compose.

Re: Omarchy: Any User Process Can Escalate to Root

#293

Post by bigstrat2003 »

vga1 wrote: post #201
lproven wrote: post #191

Earlier quoted context omitted.

No no, be fair -- some of us ridicule everyone using AI and the slop they get it to extrude.

Yes, I know. That is quite juvenile.

No, we are judging them by the quality of the work they produce. It is abysmal, yet they persist, so they get ridiculed.

Re: Omarchy: Any User Process Can Escalate to Root

#294

Post by matheusmoreira »

JeremyNT wrote: post #289
Aurornis wrote: post #174

Earlier quoted context omitted.

> What is different here? I don’t understand how this is a question. What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be. You can choose to configure your installs this way if you choose to do so. It should not come this wa…

The whole point of Omarchy is for people who want to use Arch Linux but have it configured the way DHH does. So I think it's a little different. Anybody using an opinionated respin should understand what they're getting.

> people who want to use Arch Linux but have it configured the way DHH does

Then they don't actually want to use Arch Linux.

The Arch Linux way is to read the excellent wiki documentation, learn about all the choices available, and then make all of those choices so the system is configured the user's way instead of some celebrity's way.

Re: Omarchy: Any User Process Can Escalate to Root

#295

Post by amluto »

inigyou wrote: post #283
amluto wrote: post #244

Earlier quoted context omitted.

Documents containing scripts are genuinely useful, as are, say, Python programs.

A python program isn't a word document

People write real software using Microsoft Office's scripting features. Sure, it's not "cool" the way that Python is cool, but it works.

And neither Microsoft nor Python has a credible security model.

Re: Omarchy: Any User Process Can Escalate to Root

#296

Post by PuercoPop »

phoronixrly wrote: post #6
nkydr0i0 wrote: post #4

Earlier quoted context omitted.

that's what I do and what the author recommends as well

Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..

Don't use podman compose unless you want to have a bad experience. Play kube is podman's API for orchestration.

Re: Omarchy: Any User Process Can Escalate to Root

#297

Post by mort96 »

tasuki wrote: post #249
LinXitoW wrote: post #188

Earlier quoted context omitted.

For a single user, opinionated, modern, developer focussed OS, this is completely and utterly on par. Using docker as a developer without this is just plain annoying.

Just use podman, as the article suggests.

Too much stuff doesn't work with Podman still.

Especially if you're on an SELinux system.

Re: Omarchy: Any User Process Can Escalate to Root

#298

Post by lucideer »

teekert wrote: post #157
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

I don't think this is as widely known as you believe: I use dockerd via colima so it's not a limitation I've encountered - if I had, I likely would've switched to podman wholesale instead of compromising my system.

Either way though, I would hope it's self-evident to most that taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS is generally not desirable.

Re: Omarchy: Any User Process Can Escalate to Root

#299

Post by LightBug1 »

addajones wrote: post #187

Sad that people just complain about what DHH is doing and how he doesn't know anything. Nobody is forcing anybody to use Omarchy at all. Also $10 million was raised by him for it, did anybody else here raise that for a distro? I'm tired of the constant complaining and criticizing. Nobody said you have to use it.

Interesting point. I'll summarise my counter response as: fuck DHH. Guy can shove an omarchy up his jacksy.

Re: Omarchy: Any User Process Can Escalate to Root

#300

Post by sva_ »

inigyou wrote: post #209
sva_ wrote: post #77

Earlier quoted context omitted.

Even if you introduce bugs in your UI (which I think is not very likely if you have a basic understanding of your system), the chance that someone would exploit software that literally only runs on your own machine seems extremely unlikely to me. I've been using arch for over 10 years btw.

Isn't the other half of AI that we can afford to look for exploits in one-off software?

I am not sure how someone would run an LLM on my computer to look for exploits as the source code is only available on my machine?
Post reply on HN