Earlier quoted context omitted.
There's no reason to use homebrew on Linux. Your package manager is better in every respect. Just don't.
Package managers are often out of date.
Which is why they allow you to add new repos like ppas.
Omarchy: Any User Process Can Escalate to Root
581–590 of 590 posts
Re: Omarchy: Any User Process Can Escalate to Root
#582Re: Omarchy: Any User Process Can Escalate to Root
#583So they are both evil and incompetent? Why don't they just work for Microsoft? ;-)
Re: Omarchy: Any User Process Can Escalate to Root
#584Earlier quoted context omitted.
Yes, it does. None of this information changes the fact that, on a fresh install of Ubuntu Server 24+, the default user can privilege escalate to root using a few LXD commands. https://starlabs.sg/blog/2026/06-old-wine-in-a-new-bottle-a-... And yes, I've tried it myself, it works as advertised.
Ah, Ubuntu _Server_. I'm tempted to dismiss this by simply saying "Server Linux != Desktop Linux", but yeah, I don't like that this is on by default either. I mean, this is a setup that ships with a default password that's the same as the username, and the first thing I do on all my server installs is disable all default user accounts and enable passwordless sudo. From reading other docs of Ubuntu Server, it appears…
[dead]
Re: Omarchy: Any User Process Can Escalate to Root
#585I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall
OP here, I couldn't agree more.
Re: Omarchy: Any User Process Can Escalate to Root
#586Earlier quoted context omitted.
Thats pretty good, then he should have made a toolkit for building and rolling your own badass distro and not a "opinionated" "omakase" system that claims to solve all of deskop linux while personally mocking a lot of people that actually have made real contributions as "clowns".
His tone is horrible. Because he implies untrue things while being 100% certain. He will paint entire communities as against omarchy when it’s just a couple left wing members with a stupid take. It doesn’t help the distribution is just … not that good.
Yeah, he also doesn't seem to separate those of us that hate omarchy because its a stupid distro from those of us that hate omarchy because of the authors annoying political loudness. It's a convenient tool though, label all the detractors as hating him for political reasons when the distro is objectively kinda pointless.
Re: Omarchy: Any User Process Can Escalate to Root
#587Earlier quoted context omitted.
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…
> What is different here? I don’t understand how this is a question. What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be. You can choose to configure your installs this way if you choose to do so. It should not come this wa…
Exactly.
Re: Omarchy: Any User Process Can Escalate to Root
#588Earlier quoted context omitted.
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…
A distro should be secure-by-default. Omarchy’s design here was insecure by default while the docs have the impression that Docker might be running rootless. Pairing insecure defaults with docs that claim better security is bad.
yeap
Re: Omarchy: Any User Process Can Escalate to Root
#589Earlier quoted context omitted.
> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. As a QubesOS user, I beg to differ. Just because most Linux distros are negligent with sandboxing does not mean all of them are.
what are you on about? The fact Qubes has to exist proves Linux is insecure. QubesOS is not a Linux distro. It just happens to ship dom0 as a Fedora VM. But it doesn't just support Linux, it also supports Windows and BSDs. None of Qubes security guarantees come from the Linux kernel.
[deleted]
Re: Omarchy: Any User Process Can Escalate to Root
#590Earlier quoted context omitted.
> It's not an SGX problem, it's inherent to enclaves not having enough trusted hardware like signed clocks, tamper-resistant counters and so on. Those things all exist now in several forms. You were just too early! (I know the feeling from past companies). SGX is a giant pile of design flaws I abandoned pretty early, but _TDX_ is what SGX should have been, and AMD sev-snp is wildly ahead allowing hardware memory encr…
Now I'm curious, how do TDX enclaves get secure time and prevent rollback attacks on the VM? NTPS? Where's the secure counter you'd need to stop the disk image being rolled back? A lot of the attacks I discovered on SGX (the concept, not the implementation) were to do with the adversarial operator being able to roll back and replay inputs to the enclave. For example, you couldn't use a password to protect anything, b…
Sorry just saw this reply.
Absolutely agreed that downgrade attacks are a real problem, though TPMs can easily mitigate this by using their monotonic counter functions.
Still, secure time is useful for many things. There are a lot of network protocol approaches to secure time, but for applications where it really matters where you cannot trust GPS, atomic clock PCI cards are in the low thousands of dollars now.