4 ms·
A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5
by concinds 27d ago
A few days ago someone found they were flowing USB descriptors straight into the shell.
https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5506a803d89 https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...
Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
- jp_sc 27d agoIt's definitely not why *I* switched away from Windows
- Brian_K_White 27d agoYou didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.
- AshamedCaptain 27d agoWhile I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is free. Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.
- normie3000 27d agoIsn't Windows also basically free? Every laptop I buy has a Windows licence stuck to the bottom of it.
- AshamedCaptain 27d agoNo and you missed the "freedom" part of the adage.
- itishappy 27d agoNo, you've been charged for every one of those licenses.
- fhn 27d agowhich means you paid for it. just because it comes bundled doesn't mean always it's free. https://en.refund4freedom.org/ https://en.refund4freedom.org/
- inigyou 27d agoYou can also just pirate it.
- Brian_K_White 27d agoWindows is already free for ~everyone. Make less idiotic arguments.
- dist-epoch 27d agoIn EU at least you can almost get free as in beer Windows, you can buy a fully legal 2nd hand (resold) Windows license for about $10, the price of a fancy beer.
- itishappy 27d ago> Also, the statement was valid because it will be true for most. The statement seems more like a preconception than data.
- jp_sc 27d agoMy reasons to switch to Linux from Windows were very little about "security" and plenty more about freedom. Sure, it was very nice avoiding running an antivirus, but that was just the cherry on top. I wanted the freedom to change and "rice" my desktop however I wanted, and the Compiz cube looked awesome. I found Windows condescending and restricting in that regard. Yes, my first reason was the aesthetics, kick me out of the nerds club. (That was also the reason I switched to Mac for 10 years). My second reason was that I suspected I could learn so much more about computers using Linux full time. And I did. I was also younger and used to associate Windows with soul-sucking corporate jobs and Linux with new ideas and experimentation. It was us-vs-them. Open Source vs Micro$oft and all that vibe.
- Dylan16807 26d agoI'm sure "superior software" is true for most, but that's a much wider goalpost than the people specifically worried about security/vulnerabilities. One of the biggest factors pushing people to Linux lately is the increasing number of ads and annoyances being crammed in to Windows. Security has been moderate for a long time.
- silisili 27d agoOther than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.
- seaal 27d agoWell the whole point is to have a good foundation and then make it actually yours, and the only necessary key binds are probably SUPER+K for the key bind cheatsheet and SUPER+SPACE for the menu. Also the community is large so there's usually someone that has already had your issue and resolved it. The amount of themes and plugins are growing everyday. A bare arch+hyprland install really feels terrible to use and has a much larger barrier to entry than Omarchy. https://plugins.omarchy.org https://plugins.omarchy.org https://omarchythemes.com https://omarchythemes.com
- montagmakes 27d agoHey, do you have any concerns about malware, in case of using the plugins or themes from these websites ? I was a bit skeptical, considering all the malwares that are being found in the package managers and plugins are pretty much the same thing but as extensions.
- itishappy 27d agoThat is the appeal. It's an opinionated distro designed around keyboard navigation.
- mosura 27d agoIt is kind of nuts how little attention this more-than-controversial-enough aspect of it gets compared to anything else, to the point people don’t even know this about it. I happen to hate Omarchy for the precise reason I don’t want that sort of interface, but apparently everyone else does, and if they do that’s up to them.
- onesandofgrain 27d agoThis seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby
- awesan 27d agoOmarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging. It's not the same thing as allowing some AI contributions under strict guidelines.
- deleted 27d ago[deleted]
- deleted 27d ago[deleted]
- vga1 27d agoEven worse. They don't even have AI review them. I fed the commits that introduced the problem to a few frontier models and they saw several problems, including the aforementioned security problem. Even Mistral saw it. I did have to instruct all models to look for security problems, though, but still. It's not that we shouldn't use vibecoded distros. It's that we shouldn't use badly vibecoded distros with shitty or non-existent processes.
- thegrim33 27d agoOn Lex Fridman recently DHH was enthusiastically bragging about how he was letting AI generate C++ that he intentionally wasn't even looking at, he was treating it as a pure black box and just submitting the output.
- dzonga 27d agothe unfortunate thing - is the money pumped into omarchy + the hype around it .... a lot of sheepish followers will just follow the hype. the tech might gets fixed later.
- rs_rs_rs_rs_rs 27d ago[flagged]
- deleted 27d ago[deleted]
- __pache__ 26d agoyou mean the fun and DX? lol
- mike_hearn 27d ago"Someone" didn't find that, AI found it. So it's not clear what your point is about vibe coding. Would humans have noticed this problem, especially given that it's not remotely exploitable? (you have to plug in a malicious USB device).
- miguelbemartin 27d agoI think they mean that Omarchy is pretty much vibe-coded. Probably just an assumption.
- mosura 27d agoThe fact comments like this get downvoted because what they say is inconvenient is one of the major signs AI has fundamentally broken HN. It was already hard to have technical conversations in public, now there is a contingent determined to make it utterly impossible, and they are succeeding.
- teekert 27d agoBut, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions online tell you to make yourself part of the docker group for convenience (like the digital ocean one).
- vga1 27d ago[flagged]
- lproven 27d agoNo no, be fair -- some of us ridicule everyone using AI and the slop they get it to extrude.
- vga1 27d agoYes, I know. That is quite juvenile.
- mistercheph 27d agoIn good faith, show me the nice counterexamples of ai-generated software?
- vga1 26d agohttps://github.com/vicrodh/qbz https://github.com/vicrodh/qbz
- bigstrat2003 27d agoNo, we are judging them by the quality of the work they produce. It is abysmal, yet they persist, so they get ridiculed.
- 27d ago
- lokipumper 27d agoVibecoded fixes are quicker
- sergiotapia 27d agoOn the flipside, once you use an OS that is totally open to agentic stuff, there's no going back really. I can open Pi and ask it to fix some window tiling issue, help me install shortcuts, help me figure out how to install flatpak vs appimage, etc. the list is endless. I cannot see myself going back to a legacy OS unless I'm forced to by my job for compliance reasons.
- skydhash 27d ago> etc. the list is endless. Why is the list endless? I don’t even remember the last time I check or change any on my mac settings. And my unix things haven’t been touched in months. My debian server is basically frozen at this point.
- sergiotapia 27d agoI encourage you to think more outside of the box and dream. There is much more you are able to do now, that would have been impossible 2 years ago! :D https://x.com/SergioTapiaDev/status/2094187967900266573 https://x.com/SergioTapiaDev/status/2094187967900266573
- skydhash 26d agoThat’s like one of two lines of i3status. Awesome if you need something like this one and built it. But don’t pretend that there aren‘t myriad solutions out there that have solved a lot of possible use cases.
- magarnicle 26d agoI know this isn't your point, but world clock widgets have been a think since Windows Vista at least.
- bschwindHN 26d agoI can't tell if this is performance art or not. "Think outside the box and dream!" "Here's a world clock widget."
- 27d ago
- deleted 27d ago[deleted]
- TZubiri 26d ago>If you use Omarchy, the most important takeaway is simple: update to 4.0.1. More like, don't use Omarchy, or vibecoded Operating Systems. Running a descriptor into a shell command is laughably sloppish.
- zer0zzz 26d ago> It's why you switched away from Windows in the first place, remember? Really good reminder I gotta say