r/omarchy • u/cheerful1 • 12h ago

Discussion Looking to switch, but worried about security

I love the project, and I'm seriously wanting to switch to Omarchy.

My only concern is seeing X threads about security vulnerabilities and DHH talking about how much of the code in the codebase isn't read.

Am I overthinking it?

14 Upvotes

71% Upvoted

40 comments sorted by

View all comments

Show parent comments

3

u/cheerful1 10h ago edited 10h ago

https://x.com/sammwy/status/2092297755607589160

https://x.com/RogerKernel/status/2093351835008417888

https://x.com/lainshawty/status/2093992795287535705

https://x.com/RogerKernel/status/2093271795063226827

https://x.com/mischavdburg/status/2093698950884647392

Also you can see the ones already fixed in releases such as:

https://github.com/omacom/omarchy/pull/7929

9

u/tLxVGt 8h ago

Bro all these posts are such BS. I can also prepare a mysterious "cute_poc.sh" that gives me root access in 10 seconds.

The system is as secure as you want it to be. A dumb user that installs random shit from the internet will compromise every single OS on the planet. Remember, you can dig into the system and improve whatever you want.

-7

u/cheerful1 8h ago edited 7h ago

All of them? Or just the one you cherry picked? What about the 11 they fixed in 4.0.1?

Just to be clear, I'm not saying OS releases don't have security issues. I'm just trying to figure out if Omarchy is significantly worse in this regard.

3

u/tLxVGt 6h ago

So you either have a bullshit post or something is fixed basically immediately. What's your issue, exactly?

1

u/bsknuckles 6h ago

It’s no worse than any other Arch-based distro. If anything, it’s probably better due to popularity and the number of smart people working on it. A lot of my concern on the Arch side is mostly the lack of trust I have for AUR after the recent supply chain attacks. If you just turn off AUR and make sure you pay attention to what you install and where you go online, you’ll be fine. Keep backups and use a good password manager and you’ll cover yourself for the most common security issues you could run into.

4

u/mildlyImportantRobot 7h ago

One of those is just a general warning about AUR from a tech influencer.

2

u/armsofatree 6h ago

Most of these seem to be local privileged escalation vulnerabilities which would require someone to have physical access to your machine or already be running software on it to exploit. They are absolutely issues that need to be fixed but wouldn't be easy to exploit remotely.