Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy development practices lead to predictable security issues

blog.happyfellow.dev

Post reply on HN
Print view View original

221–230 of 480 posts

Re: Omarchy development practices lead to predictable security issues

#221

Post by freehorse »

Hugsbox wrote: post #10

I'm somewhat out of the loop, and it's not really mentioned in the article, but what's with Omarchy getting this crazy amount of financial support from this list of fairly prominent individuals? Until a few weeks ago I'd never heard of it, then what I did hear is that it's being made by a very... uhh, eccentric(?) individual, and now it's suddenly got a crazy amount of funding. What am I missing?

That the future is (by some) considered to be about “personal branding” rather than actual engineering. Build a cult of followers and ship them whatever.

This is the main difference between sharing one’s cool config files and shipping a “distro”.

Re: Omarchy development practices lead to predictable security issues

#222

Post by aikinai »

pjmlp wrote: post #83
arnorhs wrote: post #69

Earlier quoted context omitted.

it's amazing from a historical perspective that there are HNers around now who don't know who DHH is, when he was such a prevailing voice in the HN scene back in the day. He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day. The golden years of HN.

Would have rails taken off if he was equally open about his politics back then?

It started in the early 2000s. Politics hadn't shifted left enough to make him right-wing back then.

Re: Omarchy development practices lead to predictable security issues

#223

Post by torstenvl »

hananova wrote: post #108
rvz wrote: post #49

Earlier quoted context omitted.

[flagged]

You’re deliberately bringing up irrelevant minimal counter examples in bad faith.

A minimal counterexample is a valid proof.

https://en.wikipedia.org/wiki/Minimal_counterexample

Please don't make personal attacks on other posters.

Re: Omarchy development practices lead to predictable security issues

#224

Post by MarkSweep »

brightball wrote: post #13
colesantiago wrote: post #2

I don't know, Omarchy's team really don't care if you're complaining. Wouldn't the security team and the agents just go and fix the security holes? They have a dedicated security team now that is being paid for this: https://omarchy.org/security/ But having a dedicated security team is marketing? I'm sure with the $10M cash chest the security will just improve over time and this blog post will be irrelevant. I don't…

Yea, I don’t get the shade. As many have said, it’s just Arch + a very polished UX preconfigured so you can jump right in without a lot of setup overhead. Why it’s security would be on a different level than any other Linux distro isn’t clear.

It’s a bit more than Arch. There are a bunch of programs written in shell and QML/JavaScript. I guess at least they are using memory-safe languages, but shell scripts make it easier to write the type of shell-injection bug mentioned in the article. Personally if I started a new project in 2026, I would not choose bash and vanilla JavaScript as the languages to write it in.

The repo for reference:

https://github.com/basecamp/omarchy

Re: Omarchy development practices lead to predictable security issues

#225

Post by poulpy123 »

jeffnv wrote: post #39
Retr0id wrote: post #26

Earlier quoted context omitted.

It's a political statement disguised as a FOSS project (which itself is fine, all software is political). The funders are not funding the development of a Linux distro, they are co-signing the political statement.

Is it? What's the statement?

I'm very far from it but I saw many exchanges in my twitter timeline (because now when you click on a tweet to read it or interact, the algorithm thinks it's your only interest in life).

Do basically, they got 8 millions dollars of funding, they bragged and criticized others in linux and said some political stuff, they were also criticized by others including political stuff from the other side (not sure of the order). Finally it became viral enough for people looking at the security of the distro and found many issues.

Personally I like my Linux distro like my coffee: competently managed, with a minimum of drama and with having to hear the less assholes possible.

Re: Omarchy development practices lead to predictable security issues

#226

Post by john_strinlai »

hokumguru wrote: post #207
lambda wrote: post #114

Earlier quoted context omitted.

He literally calls openly for the ethnic cleansing of undesirable populations from Europe. Just read his blog. There's no subtlety or nuance.

I think there's such a strong difference between remigration and ethnic cleansing. And if you are misinformed, maybe take a minute to actually read his blog posts. But if you are and willingly misrepresenting his viewpoints, then maybe take a step back and think about what that says about you. Not an endorsement of his viewpoints, but if we're going to debate people, we should do it on the actual words they say rathe…

>maybe take a minute to actually read his blog posts.

a great place to start is the one where he compares the Roma (of course, he chooses the more offensive term) to wolves that should be shot.

"When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them."

Re: Omarchy development practices lead to predictable security issues

#227

Post by ilogik »

tene80i wrote: post #204
safety1st wrote: post #153

Earlier quoted context omitted.

[flagged]

“Europe was better when it was more white” isn’t “conservative leanings”

unfortunately the current conservatives in the US do seem to align with those views

Re: Omarchy development practices lead to predictable security issues

#229

Post by kristofferR »

okinternets wrote: post #22

I have been seeing so many podcasts and YouTube videos about Omarchy in the past week or so. Must be a massive marketing push or just hype.

Just hype, it's Kagi all over again. People said the same thing there, we're just too cynical, not used to people getting excited about really cool stuff anymore.

Re: Omarchy development practices lead to predictable security issues

#230

Post by thehappyfellow »

donatj wrote: post #209
thehappyfellow wrote: post #174

Earlier quoted context omitted.

Why would I do that? It's a crazy non-sequitur. My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it. In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.

Because you could make the world a better place instead of just complaining about it? I don't understand the "all I wanna do is complain" process at all. Fix it. If you see a problem in the world, fix it. If they reject the fix, that's when you complain.

I dont just complain. I making the world a better place in ways which I believe are worth it.

Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.

Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.

Post reply on HN