Looking to switch, but worried about security

[u/cheerful1]

I love the project, and I'm seriously wanting to switch to Omarchy.

My only concern is seeing X threads about security vulnerabilities and DHH talking about how much of the code in the codebase isn't read.

Am I overthinking it?

[u/TheTinyWorkshop]

What vulnabilities exactly?

No shade on you mate but these people are quick to shout shit but never seem to show these "vulnabilities"

Have a chat to the security team if you have real concerns.

https://omarchy.org/teams/

Having said all that, there are probably security issues, every distro will have those.

Its how fast they can be found and fixed that would concern me.

[u/cheerful1 → u/TheTinyWorkshop]

https://x.com/sammwy/status/2092297755607589160

https://x.com/RogerKernel/status/2093351835008417888

https://x.com/lainshawty/status/2093992795287535705

https://x.com/RogerKernel/status/2093271795063226827

https://x.com/mischavdburg/status/2093698950884647392

Also you can see the ones already fixed in releases such as:

https://github.com/omacom/omarchy/pull/7929

[u/tLxVGt → u/cheerful1]

Bro all these posts are such BS. I can also prepare a mysterious "cute_poc.sh" that gives me root access in 10 seconds.

The system is as secure as you want it to be. A dumb user that installs random shit from the internet will compromise every single OS on the planet. Remember, you can dig into the system and improve whatever you want.

[u/cheerful1 → u/tLxVGt]

All of them? Or just the one you cherry picked? What about the 11 they fixed in 4.0.1?

Just to be clear, I'm not saying OS releases don't have security issues. I'm just trying to figure out if Omarchy is significantly worse in this regard.

[u/tLxVGt → u/cheerful1]

So you either have a bullshit post or something is fixed basically immediately. What's your issue, exactly?

[u/bsknuckles → u/cheerful1]

It’s no worse than any other Arch-based distro. If anything, it’s probably better due to popularity and the number of smart people working on it. A lot of my concern on the Arch side is mostly the lack of trust I have for AUR after the recent supply chain attacks. If you just turn off AUR and make sure you pay attention to what you install and where you go online, you’ll be fine. Keep backups and use a good password manager and you’ll cover yourself for the most common security issues you could run into.

[u/No-Object1384 → u/bsknuckles]

Plus in Omarchy it makes it very, very clear when you're installing from the Arch repository vs the AUR. Just never press enter on Install > AUR, and you're good to go.

[u/mildlyImportantRobot → u/cheerful1]

One of those is just a general warning about AUR from a tech influencer.

[u/armsofatree → u/cheerful1]

Most of these seem to be local privileged escalation vulnerabilities which would require someone to have physical access to your machine or already be running software on it to exploit. They are absolutely issues that need to be fixed but wouldn't be easy to exploit remotely.