Omarchy development practices lead to predictable security issues

Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.

I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.

Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.

One of many little quirks that no longer happen.

It’s nice to see excitement around Linux because nothing from the big names was really creating it.

The funders are not funding the development of a Linux distro, they are co-signing the political statement.

AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.

My guess is relationships and fame went a long way towards getting those funds.

In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.

Something crashes? Click the notification and your agent solves the bug.

It also has a very standardized UI library and a good plugin system.

Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.

Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.

[1] https://github.com/basecamp/omarchy/blob/quattro/default/age...

[2] https://omarchyplugins.com/

He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.

The golden years of HN.

- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)

- project jumps on some hype train (e.g. AI)

- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold

- owner also goes with the "move fast break things"

- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.

- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)

So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.

It's a vibe coding distro, so of course there is no security to begin with.

DHH is also on the Slopify board, so AI is mandatory.

edit: I don't care what people decide to do with their linux distro that I'm probably never going to use. I suggest you try Debian.

Happy to explain: it's personal blogging, for writing down what's on my mind.

The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.

Also, the "full of security holes" is not my framing, someone else choose this submission title.

Of course, this is a culture war, but the point the blog post is making is that the Omarchy side is not exactly at the forefront of merit.

Open a pull request.

That's how this is supposed to work. Wisdom of the crowd and what not.

1. https://xn--gckvb8fzb.com/a-word-on-omarchy/

Been using Linux since 1997, it's been my primary OS since ~2003 (except for gaming and Microsoft seem determine to end their streak on that one) and I use Fedora because I really don't care that much, it's a reliable tool, it has recent packages and I like that it's semi-rolling in that it's a straight forward update every 6ish months.

I had my "I must customise and control every single part of my Linux install" phase early (Slackware and Gentoo et al) and then I realised I didn't actually care all that much, give me sane defaults with the ability to tweak if I want to and stability, I'm at the point where "If I have to think much about my OS it's failed in doing what I want" holds.

More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform

I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.

Of course they’re going to react to what is reported and fix it. That’s a given.

The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.

Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.

Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.

Why it’s security would be on a different level than any other Linux distro isn’t clear.

> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?

Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.

So the "real world" is that Linux failed on the desktop and it is not worth trying, meaning that raising $10M to do this a joke?

Would you say the same thing if another distro raised that amount of money? Or is it because DHH is the one doing it.

This sort of thinking is why Linux on the Desktop worked for Windows, instead of it becoming mainstream with its own distro.

It's also funny that all the systemd critics call that bash scripts is all you need