Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

311–320 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#311

Post by montagmakes »

seaal wrote: post #99
silisili wrote: post #81

Earlier quoted context omitted.

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

Well the whole point is to have a good foundation and then make it actually yours, and the only necessary key binds are probably SUPER+K for the key bind cheatsheet and SUPER+SPACE for the menu. Also the community is large so there's usually someone that has already had your issue and resolved it. The amount of themes and plugins are growing everyday. A bare arch+hyprland install really feels terrible to use and has…

Hey, do you have any concerns about malware, in case of using the plugins or themes from these websites ? I was a bit skeptical, considering all the malwares that are being found in the package managers and plugins are pretty much the same thing but as extensions.

Re: Omarchy: Any User Process Can Escalate to Root

#313

Post by drnick1 »

mike_hearn wrote: post #105
amluto wrote: post #47

Earlier quoted context omitted.

> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. I’m sorry, what? MacOS’s desktop sandboxing is pathetic . Sure, it kind of sort of tries to prevent an application from rummaging until you give it permission. And that permission is hilariously coarse grained, and it gets regularly broken anyway. (Seriously, read about TCC breaks. They’re not little implem…

There can be exploits in any security system but the architecture is sound. There's no equivalent of TCC on Linux (I mean one that really sticks), and no easy way to create one. The sandboxing isn't bad. It's obviously weaker if you do everything in the Terminal and stay in old-school UNIX territory because it wasn't designed to sandbox developer workloads. But it's a lot better than nothing, which is what Linux offe…

> The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit.

How is that different from creating a new user to run that script? This has been the standard practice on Linux for decades, and it is how I run tools like Codex and Claude on my machine. I wouldn't allow AI tools access to files, mount points, etc, owned by my main user.

This works best for terminal apps; for GUI apps such as Steam and games where running a separate graphical session isn't practical, you can use bubblewrap.

Re: Omarchy: Any User Process Can Escalate to Root

#314

Post by jaapz »

matheusmoreira wrote: post #294
JeremyNT wrote: post #289

Earlier quoted context omitted.

The whole point of Omarchy is for people who want to use Arch Linux but have it configured the way DHH does. So I think it's a little different. Anybody using an opinionated respin should understand what they're getting.

> people who want to use Arch Linux but have it configured the way DHH does Then they don't actually want to use Arch Linux. The Arch Linux way is to read the excellent wiki documentation, learn about all the choices available, and then make all of those choices so the system is configured the user's way instead of some celebrity's way.

> Then they don't actually want to use Arch Linux.

No, they want to use Arch Linux as configured by DHH

Re: Omarchy: Any User Process Can Escalate to Root

#315

Post by [deleted] »

dzonga wrote: post #111
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

the unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype. the tech might gets fixed later.

[deleted]

Re: Omarchy: Any User Process Can Escalate to Root

#316

Post by amluto »

KaiserPro wrote: post #284
amluto wrote: post #47

Earlier quoted context omitted.

> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. I’m sorry, what? MacOS’s desktop sandboxing is pathetic . Sure, it kind of sort of tries to prevent an application from rummaging until you give it permission. And that permission is hilariously coarse grained, and it gets regularly broken anyway. (Seriously, read about TCC breaks. They’re not little implem…

I mean SElinux plus cgroups is probably good enough. Although as soon as it talks to the desktop environment all bets are off.

In my personal opinion, SELinux is a rather poor design, and I find that it actively gets in the way of trying to do security well.

Re: Omarchy: Any User Process Can Escalate to Root

#317

Post by felixfurtak »

There are definitely a few security holes in Omarchy. I tried installing their win11 docker script and that just saves the username and password of the Windows VM as plain text in a config file.

I like playing around with Omarchy since there are a lot of interesting ideas put together in a semi cohesive 'OS', but would probably not use it for anything serious until it became a bit more mature.

Re: Omarchy: Any User Process Can Escalate to Root

#318

Post by dist-epoch »

AshamedCaptain wrote: post #107
Brian_K_White wrote: post #95

Earlier quoted context omitted.

You didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.

While I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is free . Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.

In EU at least you can almost get free as in beer Windows, you can buy a fully legal 2nd hand (resold) Windows license for about $10, the price of a fancy beer.

Re: Omarchy: Any User Process Can Escalate to Root

#319

Post by al_borland »

inigyou wrote: post #232
argsnd wrote: post #182

Earlier quoted context omitted.

and in this case that's even before you get to the software opinions

Why is it always the people with the worst opinions who make the most stuff though? Why aren't the rest of us making popular stuff?

To put out something that is opinionated, one needs to risk others being critical of their opinions. People who are always worried about having the “right” opinions will rarely risk stepping out and doing something different.

So all the safe boring stuff that gets released is just a defense mechanism, where people avoid going too far in and direction to avoid being accused of having bad taste. Ironically, this creates its own lack of taste. This lack of taste is usually just ignored as boring, rather than attacked, so it feels safer.

At least that’s my read on it.

Re: Omarchy: Any User Process Can Escalate to Root

#320

Post by dist-epoch »

felixfurtak wrote: post #317

There are definitely a few security holes in Omarchy. I tried installing their win11 docker script and that just saves the username and password of the Windows VM as plain text in a config file. I like playing around with Omarchy since there are a lot of interesting ideas put together in a semi cohesive 'OS', but would probably not use it for anything serious until it became a bit more mature.

you probably mean win11 vm script, that's not really a security hole, as the host running the vm you are basically root on windows anyway, unless you bothered to encrypt the drive inside the windows vm
Post reply on HN