There's a difference between a few small bugs because software is new and a half dozen eval(untrusted_input) in version 4.0.
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
> Wouldn't the security team and the agents just go and fix the security holes?
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
Yea, I don’t get the shade. As many have said, it’s just Arch + a very polished UX preconfigured so you can jump right in without a lot of setup overhead.
Why it’s security would be on a different level than any other Linux distro isn’t clear.
It’s a bit more than Arch. There are a bunch of programs written in shell and QML/JavaScript. I guess at least they are using memory-safe languages, but shell scripts make it easier to write the type of shell-injection bug mentioned in the article. Personally if I started a new project in 2026, I would not choose bash and vanilla JavaScript as the languages to write it in.
If they are interested in complaints. Probably they do not, so people write blogs on their own. This kind of also happened in the rails world; some people got upset at DHH and then started writing complaints; and many of these complaints are by themselves also total garbage (some are more objective criticism, these tend to be better). It's kind of agenda-based everywhere.
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.
A bunch of terminally online people have decided to make stalking DHH into a personality/lifestyle. This blog is incorrectly titled, because it doesn't talk about security holes at all.
I have no clue what "shut the internet down" is supposed to mean.
How come it's never righteous when the trillionaire or Ruby guy spilled thousands of words a day on social media about immigrants but calling it out is?
> aka A person should be able to espouse xenophobic and bigoted remarks without worrying about being criticized for it.
People on the political right keep confusing freedom to say whatever you think with saying whatever you think with not having to deal with the consequences of speaking whatever you think.
DHH is free to blog about his racist beliefs and we are free to call him a racist.
Isn't the rise of AI basically turning software engineering into tumblr? Thats what I see; soon we'll have a forum that's just filled with roblox-but-for-adults.
People have taken 'everything is political' to mean 'politics must be discussed for everything'.
I am old enough that I've been burned by both sides of the political aisle, often using the same rhetoric (think of the children, we're fighting for freedom, we're fighting against fascism, no true scoctsman, etc.)
Maybe the day will come when we really will have to pick sides beyond the elections, like it's WWII, but that day isn't today. I just want to be left alone, away from political camps and the ugliness they tolerate because of they're fighting against the greater good.
There is a false equivalence happening. In this case, both sides are the people who just want to exist without being attacked for being themselves and the people who say they are wolves and that wolves need to be shot to protect the sheep.
I want people like DHH and his supporters out of the tech I use. I don't trust them, nor do I trust their judgment.
>> OTOH, fighting bigotry is something we should never leave behind.
> [we] just want to exist without being attacked for being themselves and [they say we're] wolves who need to be shot to protect the sheep.
Weird, you're the author of both of the above quotes but "just wanting to exist" is very different from "a never ending war on bigotry". It's either one or the other, can't be both because war begets war.
Just read DHH's blog and then you may quickly realise that
other distributions may be a better choice. There is a
difference between "opinionated" and ... whatever the content
criteria is for DHH nowadays to write stuff on his blog.
Younger DHH was more impressive than the TechBro aged later
variant, in my personal opinion.
Arch is in general a good base though - I mostly use Manjaro
as base, then customize it via a ton of scripts and compile
about 99% from source anyway, using an extended set of ruby
scripts (a bit similar to homebrew, but one big difference is
that I wanted versioned AppDirs like in GoboLinux; my scripts
originated from GoboLinux's philosophy since I did not want
to use shell scripts but retain versioned AppDirs. Manjaro
is in some ways a bit similar to oldschool slackware, which
unfortunately kind of died - it is not really fully dead,
but look at the homepage and then tell me how many years
past the last .iso release still counts as alive. So to me
it is dead, despite the changelogs still being updated or
others, such as alienbob, pushing out new releases.)
I'm somewhat out of the loop, and it's not really mentioned in the article, but what's with Omarchy getting this crazy amount of financial support from this list of fairly prominent individuals? Until a few weeks ago I'd never heard of it, then what I did hear is that it's being made by a very... uhh, eccentric(?) individual, and now it's suddenly got a crazy amount of funding. What am I missing?
Just to provide some balance here to readers who have never heard of Omarchy before... this comment is totally cracked.
Yes, DHH has conservative political leanings, but the vast majority of people who have tried out Omarchy either don't know or don't care. The project is in no way consumed by politics. The commenter's brain obviously is, and they are seeing everything through that lens.
HN is better when the discourse doesn't revolve around reactionary political extremism. 99% of the energy going into the distro has always been people who liked to "rice" their Linux (make it look cool). If the project has a "soul" it's that. It's also a classic "hacker" thing to rice out your desktop. It's like the modern version of the demoscene. It's fine. It's cool. Sorry if someone hurt you. Now let's move past the political histrionics.
Also: "Omarchy is not just a distribution, but it's also a counterweight to all the nonsense that has plagued Linux for far too long. It's a refuge from the clowns and the circus that has been Linux politics since the old institutions got infiltrated." (https://bsky.app/profile/steveklabnik.com/post/3mtrdmfttak2s)
Right; it's not political in the sense of "vote for candidate/party/policy XYZ", it's political in the sense that Omarchy is distinguished by being a vehicle for DHH's opinions, and by promoting Omarchy one can promote the general idea that DHH is a respectable guy with good opinions while still remaining firmly situated in "technical" subject matter.
I don't mean to get distracted from the topic at hand, but is that really true? If I create my own software stack for the TRMNL display I received as a gift because I think it's fun and interesting, is that a political statement? What politics does that involve? If someone makes a small Rust library that implements some days structure and a few hundred people find it useful, what political stance is intrinsically baked in by the author?
It's exhausting to go through life if you think every field is a battlefield.
I mean, yeah, you can't have politics in a vacuum. But any software that does anything interesting interfaces with the outside world at some point (via human proxy or otherwise).
That your TRMNL even allows you to write software for it is a choice (a cool one at that), and contributing to their ecosystem supports that choice.
> It's exhausting to go through life if you think every field is a battlefield.
You don't have to think every field as a battlefield, but your choices are affected about your beliefs and stance.
For example, some people believe that going all SaaS for everything in their life is not bad, and they can afford that, so they do that.
I personally don't trust companies much, and value my freedom a lot. So I self host the things I can and find valuable. I have my small infra which is not accessible from open internet, and I install services there if I want them to be unavailable to the public.
I mean, nobody will try to get my mundane code from my hands, but having it in a box in front of me makes me happier and feel better, so I do it.
Also, stances doesn't have to be loud/violent/up to the nose. You can be yourself with your own stance, and build it calmly and slowly. You can be just happy about achieving what you wanted to achieve.
On the other hand, software licenses are of course political and the issue can get heated and gets heated semi-regularly. We're humans and being opposed to each other in various forms is our base nature.
So, don't stay at DEFCON 1 all the time, but aware that range from 1 to 5 is always a possibility.
The same people who love to push this "everything is political" drivel will also tell you that there "is no ethical consumption in capitalism". But somehow, in this particular instance, they feel compelled to impose an absolute purity test of your capitalist consumption regardless.
Since I don't really believe in a universal right or wrong sentiment, I'll just say I think it depends on each person's own interpretation/definition of the word politics.
I don't personally care what people define it as to them, but if I were to look in my dictionary, I personally interpret that definition to mean "any time someone tries to influence others."
Now... we could argue that software by definition is trying to force people to only use it in a certain way (the way it's written or how it executes), and that that is by definition, political. We could also argue that bug reports and feature requests are also political because you are trying to influence the developer or community of a project in how they run things.
Not everyone is going to agree with those conclusions, and that's ok, because IMO there isn't a simple "right" or "wrong" answer.
> If someone makes a small Rust library that implements some days structure and a few hundred people find it useful, what political stance is intrinsically baked in by the author?
Giving away for free things of value, contributing your work without compensation is a political action.
As for your trmnl project - how can you make your own software? Are the specs open? Do you use a free and/or open toolchain?
Is there are risk patents might deny you any of this?
It's easy to think things are "apolitical" when resting on the laurels of the results of political struggles and revolutions that brought us to where we are.
The idea that you should be able to create and own your intellectual efforts, and to do so without coercion.
> political statement?
> If I create my own software stack for the TRMNL display I received as a gift
Should you own what you create? Should you BE able to create? freely?
Should you be able to give and gift freely?
> some days structure
How do you think days are defined? Think "July" is a name that came absent of politics? What about October?
Saturday and Sunday are weekends? Since when did weekends exist as we understand and enjoy them without the action of political actors (union workers striking and other people fighting for labor rights).
What holidays are holidays? Which are national holidays? Those are all political.
Did you consider that your ancestors who went through those struggles fought so that you wouldn't have to? If your Sundays and holidays consist of nothing but self flagellation, guilt and reflection for the privileged life you lead, maybe you ought to chill a little and focus on something more constructive. Believe it or not, but going outside and touching grass can be apolitical.
> It's exhausting to go through life if you think every field is a battlefield.
This is really the whole conversation. 'Everything is political' is literally true (they mean downstream of politics, in some sense) but it's really only brought up habitually like this to create a political conflict. Everything is also downstream of water, but it doesn't give me the right to flood your house.
It wasn’t that long ago that omarchy got started. As far as I could tell it was a direct response to DHH giving up on Apple. He was in a dispute with them in regards to App Store publishing and sales. He seems to have since made it his personal mission to move off of the Apple ecosystem.
DHH effect. He has a very strong following, and there's a certain amount of trust/prestige attached to his name in the tech/startup world. For a lot of these people, DHH building something is probably enough to get them interested and willing to throw money at it.
I wonder if that will change now he's gone from edgy opinions that rile up woke people (e.g. immigration is too high in the UK) to actually advocating ethnic cleansing (not the murdery kind but still...).
omarchy is the new "i use arch, btw".
I'm too altruistic (or dumb) to understand why you would pump money into a riced arch install.
In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.
It's a verb, "to rice" means to deeply customize your system to suite your needs and/or preferences. Install a desktop environment, setup it however you like it, add panels with system information, etc etc.
The more h4xx0r-like and minimalistic, the more street cred you get.
Cosmetic improvements. Term originates from observations of asian-associated car decorations, which based on context is either a bigoted pejorative or an ironic compliment.
It's a shame because DHH seems to be going fully agentic (or at least that's his public stance), so no idea why he isn't rolling a proper distro. Looking at his repo it's just pure shell scripts (why?) and using prebuilt software. He could have rolled a custom renderer + pipeline + other software needed to make a distro work (ie a modern KDE).
Go ahead and do it. Would love to see an improved Linux rewritten with agents. My personal belief is it would take a long time, lots of money and much human intervention/guidance but if you think they’re capable alone just do it this afternoon and see how it goes.
Just DHH being loud about it, getting his billionaire friends to join, and their usual tech-bro following astroturfing it (they somehow see it as a culture war thing to fight against the oppression from other distros and FLOSS projects that have code of conducts and don’t want to work with racists)
It’s a really strong UX that’s rapidly improving without a profit motive and people are excited about it.
Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.
Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.
One of many little quirks that no longer happen.
It’s nice to see excitement around Linux because nothing from the big names was really creating it.
First time huh? They already have investors (called "patrons" so far). OpenAI shown the non-profit status can be used to jump start for-profit ventures, I'm sure everyone involved here studied closely exactly how Altman pulled it off.
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
He would have had better success by literally prompting his agents to copy Apples desktop environment.
Are all the updates still handled by clobbering bash scripts?
Last time I looked into it, the technical approach was equivalent to throwing a bunch of things at a gas fire. It's just a pre-configured arch install that introduces a metric ton of tech debt.
> Closest thing to the “it just works” experience that Mac was always known for
I see this repeated a lot, but the people I know who tried Omarchy were always fixing something or dealing with breakage from an update.
The best argument I’ve heard for Omarchy that is actually consistent with what I’ve observed is that it ships with cool looking default configs for everything that make it feel fun to use.
The belief that everything just works seems more like a belief perpetuated by the messaging push behind it. Every time real issues pop up they get explained away as being due to someone’s local config changes or forgiven because it’s a young project. Even in this thread there are dozens of comments downplaying security issues as not a problem because they will get fixed, which is a symptom of a project where the messaging has gotten ahead of the facts.
The main case for Omarchy to me is the OOTB experience, which is more "good to go" than pretty much any other distro, also the hotkeys and config setup are both power user friendly. You are correct that updates have had brick-risk, though I think they've gotten better. I prefer some elements of plasma to the hyprland setup, but agents are very good at making config changes, it's much faster than navigating menus or finding lines in a config file (human work time, maybe not wall clock time).
More stuff people actually use is installed by default with Omarchy, whereas Ubuntu packages a lot of stuff I don't think people use to try and come to checkbox parity to windows, while missing useful commercial software. Omarchy comes with vscode, 1password, obsidian, chromium, discord, docker, OBS, zoom, signal/whatsapp, etc pre rolled and configured.
1. These are trivial to install on any other mainstream distro. I’m talking one-click through discover or Gnome software.
2. Most of these are not even desirable for most people. Obsidian? 1password? Come on, these have vanishingly small amounts of users. It’s not chromium.
3. Any hand-rolled arch based distro is going to be more maintenance and higher friction than fedora, Debian et al. That’s just the name of the game. It’s what makes arch desirable, too, so no, it won’t change.
4. WMs are much higher friction than full service desktops like KDE and GNOME. Again, name of the game. And it also won’t change, because that’s what makes WMs desirable.
I think people who think Omarchy “just works” have not used enough Linux distros. Which is fine, not everyone is a Linux veteran. But then don’t go around claiming it’s sooo much better than other distros. It’s not. Give Debian, fedora, even Ubuntu a shot if you want something that works OOTB.
And based on just on the list above that'd be at least 11 clicks (a lot more since you'd need to find the app in the software manager first before you can click install"
I guess we can compromise and say two clicks and some key presses.
On KDE: Press meta, type "discover", type "discord", click "install". Or, if you use KRUnner, press alt-space, type "discord", click "Get Discord", click "install"
Bear in mind this is how it works for all software in a proper desktop environment. Steam works the same way, or Zed, or whatever VPN you use.
Without a profit motive huh? Let's examine that... From Omarchy's website: "Incubated at 37signals (makers of Basecamp and HEY)." For those unfamiliar with 37signals, here's their take on the profit motive:
> 04. Profit motive
>
> The tech industry is especially good at losing money. Growth is electric, but profits are elusive. We take an old school, economics 101 approach: Make more than you spend. That’s why we’ve been profitable every year we’ve been in business. It’s the responsible way to be reliable and take care of customers over the long haul.
Oof, they explicitly say they want the opposite of what you claim.
I mean it should be pretty obvious, when an open source project kind of comes out of nowhere like this and suddenly everybody's talking about it, it's not organic growth. It's an incredibly transparent marketing campaign designed to trick people into joining the cargo cult. You need to learn to recognize these things.
I think there is a pretty decent swath of people willing to rally behind someone who says they are trying to make a cool project specifically for people who want to be away from the "insufferable injection of identity politics". How large that swath is relative to the other is up for debate but it doesn't have to be particularly large. You'll get funding from people who are both interested in the actual product AND the posture, some from people who are just into the posture, and some who are just into the product. Ditto with interest from people to try it and or contribute time to it's development.
This. The alt right in German speaking countries are calling themselves "Identitäre", which was inspired by French Les Identitaires. For all their criticism of what once was just a niche and fringe academic leftist movement, they are hypocritically are mirroring at least mirroring it if not more so. I believe they have actually helped progressive identity politics become mainstream as a reaction to their attacks on minorities, as a reaction to their hatred the mainstream has signaled their solidarity with minority identities, this is the main reason for Rainbow flags, to show solidarity against hatred.
Are there any examples of identity politics influencing the Omarchy product?
I think the comment is more about how identity politics kept infecting products through 'woke 1.0'. donglegate, language policing, default branch names, speaker progressive stacks, diversity hiring practices and blacklisting. I don't think I've seen these political issues influence DHH products the same way.
isn't it a typical SV investor money hype train situation:
- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)
- project jumps on some hype train (e.g. AI)
- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold
- owner also goes with the "move fast break things"
- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.
- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)
So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.
it's amazing from a historical perspective that there are HNers around now who don't know who DHH is, when he was such a prevailing voice in the HN scene back in the day.
He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.
It is going to be marketed to the AI bros. Possibly to Shopify customers as an "advanced AI distro" to create shops with. The openclaw guy just sponsored Omarchy.
It's a vibe coding distro, so of course there is no security to begin with.
I'm surprised HN failed to mention the real reason in this thread. It's AI. The goal of the project is to have users build (fix, maintain, expand etc) the distro themselves through AI generated (bug) reports which are then picked up by AI, solved, tested and published in a new release. A full AI loop.
AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.
It's AI and dev forward in a brilliant way. It ships with its own skill [1], so
agents actually work way better out of the box than on other distros.
Something crashes? Click the notification and your agent solves the bug.
It also has a very standardized UI library and a good plugin system.
Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.
Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.
Just like anything in tech recently, make a halo effect around whatever, over sell it, try to make a fanbase, and some connections here and there, and you got your meme product into a multi million product. It’s sad, there are dozens of better distributions out there and been in the game for years that deserve more exposure, but oh well.
The promise of the so-called ‘malleable computer’:
a machine whose hardware parts you could change, as well as bigger chunks of its software, above and beyond end-user apps. That is possible via the integration of the OS with AI agents that do the heavy lifting for you in adapting the OS to your ‘needs.’ Users of the Pi coding agent get a better feeling for this because the tool is, by design, built to respond and adapt to user-commanded changes. This is the kind of capability the typical user won’t see in private-source OSes like Windows and iOS, especially because they have security as a concern (thus the OP’s motivation for the heads-up on security in Omarchy).
That the future is (by some) considered to be about “personal branding” rather than actual engineering. Build a cult of followers and ship them whatever.
This is the main difference between sharing one’s cool config files and shipping a “distro”.
Been hearing about Omarchy for a while (past half a year if not more), but pretty much exclusively on LinkedIn. I don't remember if I follow DHH but I suppose enough of my connections do either way that I often get recommended posts about Omarchy. But I barely hear about it on reddit and I probably saw it mentioned a couple times here on HN
1. To help linux take over desktop (vs macOS and windows)
2. As an apolitical refuge, since contributors like DHH and Tobi Lütke [along with possibly the silent majority], want to focus on commonalities (love of hacking and computing) rather than the things that drive us apart (political views)
DHH is a massive racist who thinks immigrants are diluting the national character of the UK. DHH himself is danish and hasn’t been to the UK in like 10 years. Maybe he should look in the mirror sometime
It's apple-centric tech bros discovering linux. If apple gets their shit together on the OS again, they'll be back in an instant. Until then, it's probably a good thing for the linux desktop overall.
Using bash for all this stuff is like trying to wash your car with sandpaper instead of soap and water. Yes it can work if you're really careful with it, but in practice no
heh... i still remember the very first time when it came out with it's opinionated branding and all that, looked good and went ahead to try it out but was so annoyed with all the bloats and promoting their software's in it which made me their intentions already clear. I got to know that recently they've added option to remove all the bloats but IDC anymore. not gonna try that ever. Not to mention it was just dotfiles painted on top of arch iso and documentation itself included archinstall guides - if that's a distro then my system with dotfiles are a distro in itself lol... though it looks like they've changed things up now, it looks like it has a iso's and all the stuffs to be called a distro now.
DHH has a large following, so do many people in this network. His blog posts are often discussed here, it's not really surprising that it gets attention and you don't need secret astroturfing or sneaky marketing if people just share / interact with it themselves organically.
They just announced the new "Omacom foundation" last Friday, with $8 million of funding from prominent tech people. That's why it's getting current flurry of attention
It's been showing up all over YT for a while if you do any searches for Linux.
I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.
Just hype, it's Kagi all over again. People said the same thing there, we're just too cynical, not used to people getting excited about really cool stuff anymore.
The "real world" is long term results. Yes, this is a joke amount of money for building an OS if the goal is conquering desktops and holding the territory. It is obvious to everyone the "Year of the Linux Desktop" attitude with only $10M in funding isn't going to end the way they want.
Not following Omarchy, not even sure what it is trying to be compared to existing distros (other than an incredibly hyped up product). Not hating on DHH. But hasn't he become famous for developing a web framework (20 years ago), rather than for his technical prowess as a systems-level engineer? Seeing these kinds of bugs is not exactly unexpected.
the man shat out a collection of half working shell scripts and bad synthwave background images and every wannabe VC bro felt like a haxxor installing it.
Fucking hell, even Hannah Montana Linux is of higher quality than Omarchy, the bar is low.
I mean your article is pretty bad. You posted two promptly patched security vulnerabilities and then essentially just wrote the same thing over and over and over again about how it's a sign of the whole project without really building up a case showing consistent negligence.
It was (my) main takeaway and I wanted it to be evident in the headline. I didn’t want to bury the lede; I’ll uneditorialize it because it seems it’s causing some fighting in the comments and I don’t really want to instigate anything, more just warn people using the distro. I don’t think it’ll reach the people who need to be warned if it’s not evident that there’s an issue from the start.
At this point, it looks like some here in the Linux community have a new found hobby of actually liking to get angry at things instead of building now that AI took away their identity.
This is just a person having fun building their own distro. If you don't like it why are you giving them so attention even though you will never use it?
It is probably true that it has a big attack surface. But omarchy is no doubt a huge driving force. A few days ago I listened to a podcast dhh talking about the latest major release and its huge donation. I believe it’s now 10m usd or something. I am hopeful that dhh is serious enough to address the security issues plus a lot of ux improvement on linux.
In the episode he emphasized 17 layers of security layers where I remember the number solely because I found hard to believe to be honest.
There is this meme of a bell curve where the left side is some newbie trying to do something obvious, the right side is a "pro" trying to do the same obvious thing, and the middle is a someone trying to do cool/new/trendy stuff.
The left side us Ubuntu/Fedora. The right side is Arch. The middle is all these tech-fluencer-wanna-bes custom-made-ai-enhanced distros.
Isn't most of the security holes still there if used arch and installed the packages yourself. A lot of people complained ssh had security issues in omarchy because it used the default settings. That would still be the same on arch?
Arch doesn't market itself as a newbie-friendly opinionated secure-by-default distro.
An Arch package having less-than-ideal default settings is pretty normal: the user is expected to read the manpages and the Arch wiki when making any alterations to their system. They guide you towards making it secure, but if you want to leave it insecure because of reasons then Arch isn't going to stop you from shooting your own foot.
Apparently the Omarchy plugin ecosystem is also a free for all like the Arch AUR, except the audience includes people who are new to Linux and less likely to understand the risks.
A lot of plugin systems are like that. (See the hyprland, noctalia, or vim/neovim's plugin systems).
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
The two linked issues are for the same bug report.
A friend has been urging me to install Omarchy for months. I’ve finally caved in after a horrible experience with highly-praised CachyOS.
All I can say is, I understand the hype. It works. The install is uncomplicated, no selecting from five legacy bootloaders, choosing versions or selecting a window manager. The tiled window manager works pretty much how I already use Mac. I like the terminal-focused system tools. Installing software is easy and lightning-fast.
I have been using Fedora for the past few years and all I can say is that the lack of distractive options is a relief. I can focus on work and ignore the wallpaper and the themes.
Between the Windows 3 days and the mid 2000s I've spent countless hours customizing the UI of every tool I used. Now I realize I was paying attention to the wrong thing.
“Full of security holes" - and two examples in the article have been swiftly addressed, ignoring that there is a whole dedicated security team https://omarchy.org/teams/
They move fast, that's for sure. But it also means they explore and fix problems fast. I don't think there is only "slow and careful" way to create things.
The same kind as a similar recent post [1] where a person pointed out a bunch of problems with Omarchy's shell scripts as examples of it being terrible.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
As I've gotten older and more experienced, I've really embraced the "just shut up and fix it" mentality. If you're empowered to do something, any time you spend complaining about it not being done is adding to the noise and a negative contribution.
This applies in life and in work. Especially in work. I straight up just shift the discussion or leave meetings if people start complaining about problems that are within their abilities to fix. It happens so much and I don't have time for it anymore.
And if you can fix it and you don't want to, just stfu and move on with your life. For the sake of all of us.
Thanks for sharing the link. I think it provides a lot of reasons why installing Omarchy or opening a pull request would be a waste of time. I can’t fix fundamental design flaws in a PR. I don’t want to try to fix apps written in Bash and QML & vanilla JavaScript. There are other ecosystems out there that are built on stronger foundations I can (and do) contribute my time to.
Well, as far as I know, the internal config systems of most popular distros like Debian, Arch, even NixOS are all Bash. There is nothing that makes Omarchy fundamentally bad design; it's pretty average.
191 comments
[ 0.20 ms ] story [ 23.1 ms ] threadWouldn't the security team and the agents just go and fix the security holes?
They have a dedicated security team now that is being paid for this:
https://omarchy.org/security/
But having a dedicated security team is marketing?
I'm sure with the $10M cash chest the security will just improve over time and this blog post will be irrelevant.
I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
Why it’s security would be on a different level than any other Linux distro isn’t clear.
The repo for reference:
https://github.com/basecamp/omarchy
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.
aka A person should be able to espouse xenophobic and bigoted remarks without worrying about being criticized for it.
"But won't someone think of the tech bro who incessantly talks out of his ass and punches down!!!!!"
How come it's never righteous when the trillionaire or Ruby guy spilled thousands of words a day on social media about immigrants but calling it out is?
People on the political right keep confusing freedom to say whatever you think with saying whatever you think with not having to deal with the consequences of speaking whatever you think.
DHH is free to blog about his racist beliefs and we are free to call him a racist.
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.
An intellectually honest guy like you is probably so furious that DHH makes a personality out of stalking entire peoples. Pathetic++, right? :^:
I am old enough that I've been burned by both sides of the political aisle, often using the same rhetoric (think of the children, we're fighting for freedom, we're fighting against fascism, no true scoctsman, etc.)
Maybe the day will come when we really will have to pick sides beyond the elections, like it's WWII, but that day isn't today. I just want to be left alone, away from political camps and the ugliness they tolerate because of they're fighting against the greater good.
I just want my tech to focused on the tech.
There is a false equivalence happening. In this case, both sides are the people who just want to exist without being attacked for being themselves and the people who say they are wolves and that wolves need to be shot to protect the sheep.
I want people like DHH and his supporters out of the tech I use. I don't trust them, nor do I trust their judgment.
> [we] just want to exist without being attacked for being themselves and [they say we're] wolves who need to be shot to protect the sheep.
Weird, you're the author of both of the above quotes but "just wanting to exist" is very different from "a never ending war on bigotry". It's either one or the other, can't be both because war begets war.
https://www.eurozine.com/blogging-the-nihilist-impulse/
https://web.archive.org/web/20240925180238/http://www.intell...
Younger DHH was more impressive than the TechBro aged later variant, in my personal opinion.
Arch is in general a good base though - I mostly use Manjaro as base, then customize it via a ton of scripts and compile about 99% from source anyway, using an extended set of ruby scripts (a bit similar to homebrew, but one big difference is that I wanted versioned AppDirs like in GoboLinux; my scripts originated from GoboLinux's philosophy since I did not want to use shell scripts but retain versioned AppDirs. Manjaro is in some ways a bit similar to oldschool slackware, which unfortunately kind of died - it is not really fully dead, but look at the homepage and then tell me how many years past the last .iso release still counts as alive. So to me it is dead, despite the changelogs still being updated or others, such as alienbob, pushing out new releases.)
My guess is relationships and fame went a long way towards getting those funds.
Packaging and marketing matters.
The funders are not funding the development of a Linux distro, they are co-signing the political statement.
Yes, DHH has conservative political leanings, but the vast majority of people who have tried out Omarchy either don't know or don't care. The project is in no way consumed by politics. The commenter's brain obviously is, and they are seeing everything through that lens.
HN is better when the discourse doesn't revolve around reactionary political extremism. 99% of the energy going into the distro has always been people who liked to "rice" their Linux (make it look cool). If the project has a "soul" it's that. It's also a classic "hacker" thing to rice out your desktop. It's like the modern version of the demoscene. It's fine. It's cool. Sorry if someone hurt you. Now let's move past the political histrionics.
Margaret Thatcher and Ronald Reagan were conservatives.
DHH is at best an apologist for convicted criminal fascists like Stephen Yaxley-Lennon, and at worst is potentially a fascist himself.
There is a reason why some people have decided to give this distribution $8m, and not another distribution. That reason is political alignment.
Pretending it isn't, is just putting your head in the sand.
https://bsky.app/profile/aly.codes/post/3mttrv3hjcc27
While not commenting on the rest, I just want to point out that Omarchy is not a distro (yet?).
Source: https://xn--gckvb8fzb.com/a-word-on-omarchy/?:~:text=Wikiped...
It's not even a Linux distro. It's an Arch respin with tweaks that DHH likes.
This is for people who want to work like DHH.
I don't mean to get distracted from the topic at hand, but is that really true? If I create my own software stack for the TRMNL display I received as a gift because I think it's fun and interesting, is that a political statement? What politics does that involve? If someone makes a small Rust library that implements some days structure and a few hundred people find it useful, what political stance is intrinsically baked in by the author?
It's exhausting to go through life if you think every field is a battlefield.
That your TRMNL even allows you to write software for it is a choice (a cool one at that), and contributing to their ecosystem supports that choice.
You don't have to think every field as a battlefield, but your choices are affected about your beliefs and stance.
For example, some people believe that going all SaaS for everything in their life is not bad, and they can afford that, so they do that.
I personally don't trust companies much, and value my freedom a lot. So I self host the things I can and find valuable. I have my small infra which is not accessible from open internet, and I install services there if I want them to be unavailable to the public.
I mean, nobody will try to get my mundane code from my hands, but having it in a box in front of me makes me happier and feel better, so I do it.
Also, stances doesn't have to be loud/violent/up to the nose. You can be yourself with your own stance, and build it calmly and slowly. You can be just happy about achieving what you wanted to achieve.
On the other hand, software licenses are of course political and the issue can get heated and gets heated semi-regularly. We're humans and being opposed to each other in various forms is our base nature.
So, don't stay at DEFCON 1 all the time, but aware that range from 1 to 5 is always a possibility.
Since I don't really believe in a universal right or wrong sentiment, I'll just say I think it depends on each person's own interpretation/definition of the word politics.
I don't personally care what people define it as to them, but if I were to look in my dictionary, I personally interpret that definition to mean "any time someone tries to influence others."
Now... we could argue that software by definition is trying to force people to only use it in a certain way (the way it's written or how it executes), and that that is by definition, political. We could also argue that bug reports and feature requests are also political because you are trying to influence the developer or community of a project in how they run things.
Not everyone is going to agree with those conclusions, and that's ok, because IMO there isn't a simple "right" or "wrong" answer.
Giving away for free things of value, contributing your work without compensation is a political action.
As for your trmnl project - how can you make your own software? Are the specs open? Do you use a free and/or open toolchain?
Is there are risk patents might deny you any of this?
Whole world is political.
The idea that you should be able to create and own your intellectual efforts, and to do so without coercion.
> political statement?
> If I create my own software stack for the TRMNL display I received as a gift
Should you own what you create? Should you BE able to create? freely?
Should you be able to give and gift freely?
> some days structure
How do you think days are defined? Think "July" is a name that came absent of politics? What about October?
Saturday and Sunday are weekends? Since when did weekends exist as we understand and enjoy them without the action of political actors (union workers striking and other people fighting for labor rights).
What holidays are holidays? Which are national holidays? Those are all political.
This is really the whole conversation. 'Everything is political' is literally true (they mean downstream of politics, in some sense) but it's really only brought up habitually like this to create a political conflict. Everything is also downstream of water, but it doesn't give me the right to flood your house.
https://world.hey.com/dhh/three-sacred-cows-that-must-die-so...
I think that crosses a line for even normal politically centrist (by European standards at least).
In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.
The more h4xx0r-like and minimalistic, the more street cred you get.
See https://old.reddit.com/r/unixporn (or https://reddit.com/r/unixporn without an account).
Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.
Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.
One of many little quirks that no longer happen.
It’s nice to see excitement around Linux because nothing from the big names was really creating it.
First time huh? They already have investors (called "patrons" so far). OpenAI shown the non-profit status can be used to jump start for-profit ventures, I'm sure everyone involved here studied closely exactly how Altman pulled it off.
He would have had better success by literally prompting his agents to copy Apples desktop environment.
Last time I looked into it, the technical approach was equivalent to throwing a bunch of things at a gas fire. It's just a pre-configured arch install that introduces a metric ton of tech debt.
It's a slop-linux with a racism-linux hat on.
I see this repeated a lot, but the people I know who tried Omarchy were always fixing something or dealing with breakage from an update.
The best argument I’ve heard for Omarchy that is actually consistent with what I’ve observed is that it ships with cool looking default configs for everything that make it feel fun to use.
The belief that everything just works seems more like a belief perpetuated by the messaging push behind it. Every time real issues pop up they get explained away as being due to someone’s local config changes or forgiven because it’s a young project. Even in this thread there are dozens of comments downplaying security issues as not a problem because they will get fixed, which is a symptom of a project where the messaging has gotten ahead of the facts.
If you're running Linux and you need vscode you're obviously a developer. Is installing vscode really such a difficult task to figure out?
2. Most of these are not even desirable for most people. Obsidian? 1password? Come on, these have vanishingly small amounts of users. It’s not chromium.
3. Any hand-rolled arch based distro is going to be more maintenance and higher friction than fedora, Debian et al. That’s just the name of the game. It’s what makes arch desirable, too, so no, it won’t change.
4. WMs are much higher friction than full service desktops like KDE and GNOME. Again, name of the game. And it also won’t change, because that’s what makes WMs desirable.
I think people who think Omarchy “just works” have not used enough Linux distros. Which is fine, not everyone is a Linux veteran. But then don’t go around claiming it’s sooo much better than other distros. It’s not. Give Debian, fedora, even Ubuntu a shot if you want something that works OOTB.
On KDE: Press meta, type "discover", type "discord", click "install". Or, if you use KRUnner, press alt-space, type "discord", click "Get Discord", click "install"
Bear in mind this is how it works for all software in a proper desktop environment. Steam works the same way, or Zed, or whatever VPN you use.
/r/unixporn is all about that. They don't get a $10 million fund though.
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware.
Ubuntu. Debian. Fedora especiall via Bazzite. Arch via CachyOS.
> Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth
Small example: many Steam games were dog slow or unplayable in Omarchy. I switched to CachyOS, all issues were gone.
> It’s nice to see excitement around Linux because nothing from the big names was really creating it.
None of the big names are creating anything in Omarchy. It's a bunch of vibe-coded dotfiles and shell scripts. It's hype around ricing.
> 04. Profit motive > > The tech industry is especially good at losing money. Growth is electric, but profits are elusive. We take an old school, economics 101 approach: Make more than you spend. That’s why we’ve been profitable every year we’ve been in business. It’s the responsible way to be reliable and take care of customers over the long haul.
Oof, they explicitly say they want the opposite of what you claim.
I mean it should be pretty obvious, when an open source project kind of comes out of nowhere like this and suddenly everybody's talking about it, it's not organic growth. It's an incredibly transparent marketing campaign designed to trick people into joining the cargo cult. You need to learn to recognize these things.
I think the comment is more about how identity politics kept infecting products through 'woke 1.0'. donglegate, language policing, default branch names, speaker progressive stacks, diversity hiring practices and blacklisting. I don't think I've seen these political issues influence DHH products the same way.
- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)
- project jumps on some hype train (e.g. AI)
- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold
- owner also goes with the "move fast break things"
- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.
- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)
So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.
He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.
The golden years of HN.
It's a vibe coding distro, so of course there is no security to begin with.
AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.
Something crashes? Click the notification and your agent solves the bug.
It also has a very standardized UI library and a good plugin system.
Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.
Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.
[1] https://github.com/basecamp/omarchy/blob/quattro/default/age...
[2] https://omarchyplugins.com/
a machine whose hardware parts you could change, as well as bigger chunks of its software, above and beyond end-user apps. That is possible via the integration of the OS with AI agents that do the heavy lifting for you in adapting the OS to your ‘needs.’ Users of the Pi coding agent get a better feeling for this because the tool is, by design, built to respond and adapt to user-commanded changes. This is the kind of capability the typical user won’t see in private-source OSes like Windows and iOS, especially because they have security as a concern (thus the OP’s motivation for the heads-up on security in Omarchy).
This is the main difference between sharing one’s cool config files and shipping a “distro”.
2. As an apolitical refuge, since contributors like DHH and Tobi Lütke [along with possibly the silent majority], want to focus on commonalities (love of hacking and computing) rather than the things that drive us apart (political views)
It's lines, lines and more lines of bash script
sigh
big sigh
Using bash for all this stuff is like trying to wash your car with sandpaper instead of soap and water. Yes it can work if you're really careful with it, but in practice no
It's also funny that all the systemd critics call that bash scripts is all you need
I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.
I'd stay away just for this reason alone. Anybody that says this is either joking or has no clue how the real world works.
So the "real world" is that Linux failed on the desktop and it is not worth trying, meaning that raising $10M to do this a joke?
Would you say the same thing if another distro raised that amount of money? Or is it because DHH is the one doing it.
This sort of thinking is why Linux on the Desktop worked for Windows, instead of it becoming mainstream with its own distro.
Too few upstarts realize that proper security is core to a good experience.
I loved installing different operating systems on them and try to customize it. Better window management, better animations, nicer colours etc.
Of course, the results were always marginally better or worse than the stock version of that distribution.
Seems as this is the case for Omarchy here as well.
Some people just hate DHH and can't separate the art from the artist
the man shat out a collection of half working shell scripts and bad synthwave background images and every wannabe VC bro felt like a haxxor installing it.
Fucking hell, even Hannah Montana Linux is of higher quality than Omarchy, the bar is low.
The current submission title is terrible, "Omarchy development practices lead to predictable security issues" would be much closer.
This is just a person having fun building their own distro. If you don't like it why are you giving them so attention even though you will never use it?
In the episode he emphasized 17 layers of security layers where I remember the number solely because I found hard to believe to be honest.
You can find the podcast episode in this one https://thestanduppod.com/
The left side us Ubuntu/Fedora. The right side is Arch. The middle is all these tech-fluencer-wanna-bes custom-made-ai-enhanced distros.
An Arch package having less-than-ideal default settings is pretty normal: the user is expected to read the manpages and the Arch wiki when making any alterations to their system. They guide you towards making it secure, but if you want to leave it insecure because of reasons then Arch isn't going to stop you from shooting your own foot.
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
It's easy enough for Omarchy folks to add "verified" or "trusted" developers down the line.
A friend has been urging me to install Omarchy for months. I’ve finally caved in after a horrible experience with highly-praised CachyOS.
All I can say is, I understand the hype. It works. The install is uncomplicated, no selecting from five legacy bootloaders, choosing versions or selecting a window manager. The tiled window manager works pretty much how I already use Mac. I like the terminal-focused system tools. Installing software is easy and lightning-fast.
Between the Windows 3 days and the mid 2000s I've spent countless hours customizing the UI of every tool I used. Now I realize I was paying attention to the wrong thing.
What kind of blogging is this?
Of course, this is a culture war, but the point the blog post is making is that the Omarchy side is not exactly at the forefront of merit.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
1. https://xn--gckvb8fzb.com/a-word-on-omarchy/
As I've gotten older and more experienced, I've really embraced the "just shut up and fix it" mentality. If you're empowered to do something, any time you spend complaining about it not being done is adding to the noise and a negative contribution.
This applies in life and in work. Especially in work. I straight up just shift the discussion or leave meetings if people start complaining about problems that are within their abilities to fix. It happens so much and I don't have time for it anymore.
And if you can fix it and you don't want to, just stfu and move on with your life. For the sake of all of us.
0. https://www.youtube.com/watch?v=a8MZBUoQt68
1. https://www.youtube.com/watch?v=dpKc8N3FJsQ