9 ms·
A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5
by concinds 17d ago
A few days ago someone found they were flowing USB descriptors straight into the shell.
https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5506a803d89 https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...
Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
- dzonga 17d agothe unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype. the tech might gets fixed later.
- rs_rs_rs_rs_rs 17d ago[flagged]
- deleted 17d ago[deleted]
- __pache__ 17d agoyou mean the fun and DX? lol
- jp_sc 17d agoIt's definitely not why *I* switched away from Windows
- Brian_K_White 17d agoYou didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.
- AshamedCaptain 17d agoWhile I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is free. Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.
- dist-epoch 17d agoIn EU at least you can almost get free as in beer Windows, you can buy a fully legal 2nd hand (resold) Windows license for about $10, the price of a fancy beer.
- normie3000 17d agoIsn't Windows also basically free? Every laptop I buy has a Windows licence stuck to the bottom of it.
- AshamedCaptain 17d agoNo and you missed the "freedom" part of the adage.
- itishappy 17d agoNo, you've been charged for every one of those licenses.
- fhn 17d agowhich means you paid for it. just because it comes bundled doesn't mean always it's free. https://en.refund4freedom.org/ https://en.refund4freedom.org/
- inigyou 17d agoYou can also just pirate it.
- Brian_K_White 17d agoWindows is already free for ~everyone. Make less idiotic arguments.
- silisili 17d agoOther than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.
- seaal 17d agoWell the whole point is to have a good foundation and then make it actually yours, and the only necessary key binds are probably SUPER+K for the key bind cheatsheet and SUPER+SPACE for the menu. Also the community is large so there's usually someone that has already had your issue and resolved it. The amount of themes and plugins are growing everyday. A bare arch+hyprland install really feels terrible to use and has a much larger barrier to entry than Omarchy. https://plugins.omarchy.org https://plugins.omarchy.org https://omarchythemes.com https://omarchythemes.com
- montagmakes 17d agoHey, do you have any concerns about malware, in case of using the plugins or themes from these websites ? I was a bit skeptical, considering all the malwares that are being found in the package managers and plugins are pretty much the same thing but as extensions.
- itishappy 17d agoThat is the appeal. It's an opinionated distro designed around keyboard navigation.
- mosura 17d agoIt is kind of nuts how little attention this more-than-controversial-enough aspect of it gets compared to anything else, to the point people don’t even know this about it. I happen to hate Omarchy for the precise reason I don’t want that sort of interface, but apparently everyone else does, and if they do that’s up to them.
- onesandofgrain 17d agoThis seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby
- awesan 17d agoOmarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.
- deleted 17d ago[deleted]
- deleted 17d ago[deleted]
- vga1 17d agoEven worse. They don't even have AI review them. I fed the commits that introduced the problem to a few frontier models and they saw several problems, including the aforementioned security problem. Even Mistral saw it. I did have to instruct all models to look for security problems, though, but still. It's not that we shouldn't use vibecoded distros. It's that we shouldn't use badly vibecoded distros with shitty or non-existent processes.
- thegrim33 17d agoOn Lex Fridman recently DHH was enthusiastically bragging about how he was letting AI generate C++ that he intentionally wasn't even looking at, he was treating it as a pure black box and just submitting the output.
- mike_hearn 17d ago"Someone" didn't find that, AI found it. So it's not clear what your point is about vibe coding. Would humans have noticed this problem, especially given that it's not remotely exploitable? (you have to plug in a malicious USB device).
- miguelbemartin 17d agoI think they mean that Omarchy is pretty much vibe-coded. Probably just an assumption.
- mosura 17d agoThe fact comments like this get downvoted because what they say is inconvenient is one of the major signs AI has fundamentally broken HN. It was already hard to have technical conversations in public, now there is a contingent determined to make it utterly impossible, and they are succeeding.
- teekert 17d agoBut, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions online tell you to make yourself part of the docker group for convenience (like the digital ocean one).
- happytoexplain 17d ago>Everybody knows this. I didn't know this.
- teekert 17d agoDo you know about docker compose overwriting your carefully set firewall rules? That’s the other docker thing…
- dotancohen 17d agoGo on, what other docker things should we know?
- superq 17d agoAbsolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.
- MrDresden 17d agoTake a look at docker-socket-proxy as a somewhat of a counter to this issue: https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy
- vga1 17d ago[flagged]
- lokipumper 17d agoVibecoded fixes are quicker
- sergiotapia 17d agoOn the flipside, once you use an OS that is totally open to agentic stuff, there's no going back really. I can open Pi and ask it to fix some window tiling issue, help me install shortcuts, help me figure out how to install flatpak vs appimage, etc. the list is endless. I cannot see myself going back to a legacy OS unless I'm forced to by my job for compliance reasons.
- skydhash 17d ago> etc. the list is endless. Why is the list endless? I don’t even remember the last time I check or change any on my mac settings. And my unix things haven’t been touched in months. My debian server is basically frozen at this point.
- sergiotapia 17d agoI encourage you to think more outside of the box and dream. There is much more you are able to do now, that would have been impossible 2 years ago! :D https://x.com/SergioTapiaDev/status/2094187967900266573 https://x.com/SergioTapiaDev/status/2094187967900266573
- skydhash 17d agoThat’s like one of two lines of i3status. Awesome if you need something like this one and built it. But don’t pretend that there aren‘t myriad solutions out there that have solved a lot of possible use cases.
- magarnicle 17d agoI know this isn't your point, but world clock widgets have been a think since Windows Vista at least.
- bschwindHN 17d agoI can't tell if this is performance art or not. "Think outside the box and dream!" "Here's a world clock widget."
- 17d ago
- deleted 17d ago[deleted]
- TZubiri 17d ago>If you use Omarchy, the most important takeaway is simple: update to 4.0.1. More like, don't use Omarchy, or vibecoded Operating Systems. Running a descriptor into a shell command is laughably sloppish.
- zer0zzz 17d ago> It's why you switched away from Windows in the first place, remember? Really good reminder I gotta say