Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

421–430 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#421

Earlier quoted context omitted.

I like the very non-windows very non-mac ui of omarchy.

I run Niri and Dank Material Sell on Fedora. It’s perfect, and better than Omarchy from what I’ve seen. I much prefer scrolling window managers to tilers.

Yup. I've been on zirconium (https://github.com/zirconium-dev/zirconium) for a while, and it's great. Fedora atomic/bootc under the hood with Niri+DMS. Basically bombproof.

Re: Omarchy: Any User Process Can Escalate to Root

#422
post #36

Earlier quoted context omitted.

Just use Fedora. It just werks (most times).

Fedora is an arse to use. most of the distros for non free software are targeted at stable RHEL, so are miles out of date. You only get 6 months of updates, at which point everything break subtly, or not if you use nvidia. ubuntu with a custom GUI is the way forward, at least compared to fedora.

Counterpoint: I've had very few (and always minor) problems upgrading between major Fedora releases over the years with no more effort than following the well-documented steps to do so, including both traditional and atomic variants, the latter with a wide variety of layered packages as specifically not recommended due to potential problems when upgrading.

And on the server side of things, I ran a Fedora CoreOS VM with a Pihole container that silently and successfully auto-updated both the OS and the service container for years with no intervention on my part.

Re: Omarchy: Any User Process Can Escalate to Root

#423

Earlier quoted context omitted.

> etc. the list is endless. Why is the list endless? I don’t even remember the last time I check or change any on my mac settings. And my unix things haven’t been touched in months. My debian server is basically frozen at this point.

I encourage you to think more outside of the box and dream. There is much more you are able to do now, that would have been impossible 2 years ago! :D https://x.com/SergioTapiaDev/status/2094187967900266573

I know this isn't your point, but world clock widgets have been a think since Windows Vista at least.

Re: Omarchy: Any User Process Can Escalate to Root

#424

The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well. Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff t…

Why do you think people that disagree with your opinion are gatekeepers? You can still use it if you want, no one’s gate keeping anything lol.

Re: Omarchy: Any User Process Can Escalate to Root

#425

No one serious about security touches Omarchy. Practically every distro suffers from critical LPEs, but at least there’s a bar. Omarchy is a hot mess that exists for the same reason that matcha is in our coffeeshops and peptides are in our collective memory.

Genuinely so confused about your last sentence, please explain…

Re: Omarchy: Any User Process Can Escalate to Root

#426
post #394

My most controversial opinion by far in tech circles is that I still just use a standard Windows gaming PC as my home desktop. My current machine I just bought pre-built from Microcenter, complete with a 5090 and everything. I can fire up a Linux terminal with WezTerm and WSL2 at any point. It's customized and beautiful and totally fine. I have Codex running in one right now. I can listen to Dolby Atmos music through…

Has it restarted losing your session to install an "Intel Corporation - Extension - 22.1120.5.12" yet?

[deleted]

Re: Omarchy: Any User Process Can Escalate to Root

#427

No one serious about security touches Omarchy. Practically every distro suffers from critical LPEs, but at least there’s a bar. Omarchy is a hot mess that exists for the same reason that matcha is in our coffeeshops and peptides are in our collective memory.

This is a weird metaphor - why do you think people buy matcha at coffeeshops or use peptides? Those two things don't have anything obvious to do with each other, let alone with Omarchy.

except that all three things are getting a lot of social media clout.

they just keep pumping out short form videos or yapping heads talking about how they use x to do y better than any of the old stuff...

I think this is the OP's point. they all exist because there is a lot of noise about them existing and being used.

Re: Omarchy: Any User Process Can Escalate to Root

#428

Earlier quoted context omitted.

>Everybody knows this. I didn't know this.

Do you know about docker compose overwriting your carefully set firewall rules? That’s the other docker thing…

Absolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.

Re: Omarchy: Any User Process Can Escalate to Root

#429
post #397

Was this vulnerability disclosed responsibly by the author?

Yes, it has:

> I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.

Re: Omarchy: Any User Process Can Escalate to Root

#430

Earlier quoted context omitted.

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

This. Was also super confused when I saw the post. Like every docker guide literally screams at you when you use rootfull docker. Either add yourself to the docker group with `newgrp` for a termimal session or use rootless docker.

You add yourself to the docker group to be able to use the socket. By default, a uid 0 on a docker container is run as root, regardless of the uid of the owner of the container. That is precisely the issue being discussed.
Post reply on HN