edit: I don't care what people decide to do with their linux distro that I'm probably never going to use. I suggest you try Debian.
Younger DHH was more impressive than the TechBro aged later variant, in my personal opinion.
Arch is in general a good base though - I mostly use Manjaro as base, then customize it via a ton of scripts and compile about 99% from source anyway, using an extended set of ruby scripts (a bit similar to homebrew, but one big difference is that I wanted versioned AppDirs like in GoboLinux; my scripts originated from GoboLinux's philosophy since I did not want to use shell scripts but retain versioned AppDirs. Manjaro is in some ways a bit similar to oldschool slackware, which unfortunately kind of died - it is not really fully dead, but look at the homepage and then tell me how many years past the last .iso release still counts as alive. So to me it is dead, despite the changelogs still being updated or others, such as alienbob, pushing out new releases.)
My guess is relationships and fame went a long way towards getting those funds.
The funders are not funding the development of a Linux distro, they are co-signing the political statement.
It's lines, lines and more lines of bash script
sigh
big sigh
Using bash for all this stuff is like trying to wash your car with sandpaper instead of soap and water. Yes it can work if you're really careful with it, but in practice no
It's also funny that all the systemd critics call that bash scripts is all you need
And yes while I got more favourable to Systemd I cannot say bash is all you need, no
I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.
I'd stay away just for this reason alone. Anybody that says this is either joking or has no clue how the real world works.
So the "real world" is that Linux failed on the desktop and it is not worth trying, meaning that raising $10M to do this a joke?
Would you say the same thing if another distro raised that amount of money? Or is it because DHH is the one doing it.
This sort of thinking is why Linux on the Desktop worked for Windows, instead of it becoming mainstream with its own distro.
Too few upstarts realize that proper security is core to a good experience.
No reason Qt or quickshell is any different from any other software.
Bash is... harder, not impossible. I wouldn't rely on it.
I loved installing different operating systems on them and try to customize it. Better window management, better animations, nicer colours etc.
Of course, the results were always marginally better or worse than the stock version of that distribution.
Seems as this is the case for Omarchy here as well.
Some people just hate DHH and can't separate the art from the artist
The current submission title is terrible, "Omarchy development practices lead to predictable security issues" would be much closer.
This is just a person having fun building their own distro. If you don't like it why are you giving them so attention even though you will never use it?
In the episode he emphasized 17 layers of security layers where I remember the number solely because I found hard to believe to be honest.
You can find the podcast episode in this one https://thestanduppod.com/
The left side us Ubuntu/Fedora. The right side is Arch. The middle is all these tech-fluencer-wanna-bes custom-made-ai-enhanced distros.
Been using Linux since 1997, it's been my primary OS since ~2003 (except for gaming and Microsoft seem determine to end their streak on that one) and I use Fedora because I really don't care that much, it's a reliable tool, it has recent packages and I like that it's semi-rolling in that it's a straight forward update every 6ish months.
I had my "I must customise and control every single part of my Linux install" phase early (Slackware and Gentoo et al) and then I realised I didn't actually care all that much, give me sane defaults with the ability to tweak if I want to and stability, I'm at the point where "If I have to think much about my OS it's failed in doing what I want" holds.
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
A friend has been urging me to install Omarchy for months. I’ve finally caved in after a horrible experience with highly-praised CachyOS.
All I can say is, I understand the hype. It works. The install is uncomplicated, no selecting from five legacy bootloaders, choosing versions or selecting a window manager. The tiled window manager works pretty much how I already use Mac. I like the terminal-focused system tools. Installing software is easy and lightning-fast.
What kind of blogging is this?
Happy to explain: it's personal blogging, for writing down what's on my mind.
The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.
Also, the "full of security holes" is not my framing, someone else choose this submission title.
Of course, this is a culture war, but the point the blog post is making is that the Omarchy side is not exactly at the forefront of merit.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
For people who don't know, just read "As I Remember London" by this person.
Sure, arguments can be made in favor of being "above all these things," but profound moral disgust can also be a legitimate argument.
I am happy that the Linux ecosystem is getting attention, traction and funding. People that dont like and want to choose to go die on another hill, so be it, their prerogative.
Literally the first sentence in the post has links to two security holes lol
The blog is titled "Merchants of Insecurity". The word "hole" does not exist anywhere on the page, the HTML, or the HTTP headers.
Yesterday's submission used the correct title: https://news.ycombinator.com/item?id=49433378
aka A person should be able to espouse xenophobic and bigoted remarks without worrying about being criticized for it.
"But won't someone think of the tech bro who incessantly talks out of his ass and punches down!!!!!"
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.
An intellectually honest guy like you is probably so furious that DHH makes a personality out of stalking entire peoples. Pathetic++, right? :^:
I'm not fully surprised by it. Pissing in their cornflakes and reminding everyone what they are is what matters, not points.
The same guy who followed that up by saying of an entire ethnic group he doesn't like that "When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation." [2]
The guy whose hope for society that don't involve ranting about how much he hates having other ethnicities around is that he believes "the will to power will return" [3] as the dominant force of society?
I dunno, maybe it's possible he isn't a fascist. But he coincidentally hates the same people the most famous fascists in history hated, and he proposes the same solutions they did.
[1] https://world.hey.com/dhh/as-i-remember-london-e7d38e64
[2] https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
[3] https://world.hey.com/dhh/the-will-to-power-will-return-58ff...
The "smear" you're mentioning is actually him smearing his shit all over the walls on his personal blog, and indeed, it reeks of fascism.
> You have to act. You have to protect the sheep. Standing idly by while your livestock is devoured by predators or your neighborhood is taken over by migrants is a pathetic abdication of any functioning society's most basic duty to its citizens.
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation.
No he doesn't. You're inadvertently right, it's not nuanced: he's not a fascist.
I don't think most people have read the blog.
I don't think you can assume people have read anything outside the specific page linked by HN.
Not an endorsement of his viewpoints, but if we're going to debate people, we should do it on the actual words they say rather than the things we make up in our head about them.
you can think what you want to think but this is definitionally incorrect
a great place to start is the one where he compares the Roma (of course, he chooses the more offensive term) to wolves that should be shot.
"When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them."
This is a reference to a dog whistle. Above 25kHz are sounds that dogs can hear but humans generally can't.
The term dog whistle is used to refer to phrases that racists use to indicate their racism, while sounding plausibly deniable. The idea is that it's a phrase that will make other racists realize that you are one of them, while not sounding openly racist to others.
DHH himself has gone beyond dog whistles. He's directly compared what he considers undesirable ehtnic populations to wolves who need to be shot. He's just openly calling for ethnic cleansing by now.
But support for Omarchy itself can be seen as a dog whistle. It's widely known that DHH is a fascist, but you have some plausible deniability by donating to Omarchy because you're just politically neutral and think it's cool tech, or something like that.
I don't think users know who DHH is, or care who DHH is. Probably like 0.01% of users have read a blog post, let alone a political one. (Maybe they all are, I haven't read any)
I switched to Omarchy 4.0 from CachyOS and is having an amazing experience so far, barely know anything about DHH other than that he made Rails, and now everybody is calling me a racist sympathizer.
I don't think it's anti-political overall but it's more of an attempt to revive the enthusiast/hacker ethos of the OSS community.
Do basically, they got 8 millions dollars of funding, they bragged and criticized others in linux and said some political stuff, they were also criticized by others including political stuff from the other side (not sure of the order). Finally it became viral enough for people looking at the security of the distro and found many issues.
Personally I like my Linux distro like my coffee: competently managed, with a minimum of drama and with having to hear the less assholes possible.
So a "hello world" program is now political?
I think you just want to purposefully find a reason to be angry and you love it.
There's an implicit political statement in being able to write a simple one line hello world program and run it, using free software and information. Consider the counterfactual world where to even begin programming you have to pay for certification and training or specialized equipment/software. I know paid compilers, proprietary languages and closed specifications exist, but we can still just save print('hello world') to a file and run it using python which is freely available, or even better we can open devtools in our browser and jump into the console and run console.log('hello world') without even installing anything.
https://en.wikipedia.org/wiki/Minimal_counterexample
Please don't make personal attacks on other posters.
Irony is dead.
Yes, DHH has conservative political leanings, but the vast majority of people who have tried out Omarchy either don't know or don't care. The project is in no way consumed by politics. The commenter's brain obviously is, and they are seeing everything through that lens.
HN is better when the discourse doesn't revolve around reactionary political extremism. 99% of the energy going into the distro has always been people who liked to "rice" their Linux (make it look cool). If the project has a "soul" it's that. It's also a classic "hacker" thing to rice out your desktop. It's like the modern version of the demoscene. It's fine. It's cool. Sorry if someone hurt you. Now let's move past the political histrionics.
I.e., when Omarchy is reported on in my country (on local blogs) nobody ever replies with anything political, it's just about the tech. But in some circles this is very different, somehow.
to be clear to those readers seeking balance, this is putting it mildly.
It's not even a Linux distro. It's an Arch respin with tweaks that DHH likes.
This is for people who want to work like DHH.
“Hey, you can be political on social media but don’t bring it into our work chats. We are here to do a job. If that is a problem, here’s a generous 6 month severance package.”
That was what politically blew him up and he was unwilling to apologize for a completely reasonable take.
Now he’s giving his time and money freely to make a great Linux distro.
It says more about the anti-DHH crowd than it does about him.
https://world.hey.com/dhh/three-sacred-cows-that-must-die-so...
> Because the sacred cow here is not just that mass migration must stop going forward. It's also that millions who are already in Europe must go.
He's suggesting we round up all the brown people and deport them... (He's smart enough to not put it in those words but I don't see what else it could mean.)
https://world.hey.com/dhh/three-sacred-cows-that-must-die-so...
I think that crosses a line for even normal politically centrist (by European standards at least).
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.
You don't get to make this contrast and pretend you didn't. The only way his rhetoric could be more clear is if he bought a gun and shot them himself.
In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.
It's the same reason why you mustn't recommend CachyOS to newcomers either, they're still just two people running the show, although they're aware of the risks that comes with it and trying to expand their core team.
More like “I'm a white suppremacist, btw” though.
Quite unfortunate that it became acceptable enough to brag about that in public.
Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.
Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.
One of many little quirks that no longer happen.
It’s nice to see excitement around Linux because nothing from the big names was really creating it.
A far cry from 15 years ago.
First time huh? They already have investors (called "patrons" so far). OpenAI shown the non-profit status can be used to jump start for-profit ventures, I'm sure everyone involved here studied closely exactly how Altman pulled it off.
He would have had better success by literally prompting his agents to copy Apples desktop environment.
Last time I looked into it, the technical approach was equivalent to throwing a bunch of things at a gas fire. It's just a pre-configured arch install that introduces a metric ton of tech debt.
It's a slop-linux with a racism-linux hat on.
I see this repeated a lot, but the people I know who tried Omarchy were always fixing something or dealing with breakage from an update.
The best argument I’ve heard for Omarchy that is actually consistent with what I’ve observed is that it ships with cool looking default configs for everything that make it feel fun to use.
The belief that everything just works seems more like a belief perpetuated by the messaging push behind it. Every time real issues pop up they get explained away as being due to someone’s local config changes or forgiven because it’s a young project. Even in this thread there are dozens of comments downplaying security issues as not a problem because they will get fixed, which is a symptom of a project where the messaging has gotten ahead of the facts.
literally the experience that Mac was always known for
/r/unixporn is all about that. They don't get a $10 million fund though.
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware.
Ubuntu. Debian. Fedora especiall via Bazzite. Arch via CachyOS.
> Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth
Small example: many Steam games were dog slow or unplayable in Omarchy. I switched to CachyOS, all issues were gone.
> It’s nice to see excitement around Linux because nothing from the big names was really creating it.
None of the big names are creating anything in Omarchy. It's a bunch of vibe-coded dotfiles and shell scripts. It's hype around ricing.
- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)
- project jumps on some hype train (e.g. AI)
- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold
- owner also goes with the "move fast break things"
- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.
- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)
So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.
He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.
The golden years of HN.
People's politics do often (but not always) change as they age.
I'm not sure DHH really held the same views back then, either. The "Overton Window" has moved over the last 20 years so openly bigoted and racist views are accepted in the discourse now.
It's a vibe coding distro, so of course there is no security to begin with.
DHH is also on the Slopify board, so AI is mandatory.
AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.
Something crashes? Click the notification and your agent solves the bug.
It also has a very standardized UI library and a good plugin system.
Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.
Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.
[1] https://github.com/basecamp/omarchy/blob/quattro/default/age...
a machine whose hardware parts you could change, as well as bigger chunks of its software, above and beyond end-user apps. That is possible via the integration of the OS with AI agents that do the heavy lifting for you in adapting the OS to your ‘needs.’ Users of the Pi coding agent get a better feeling for this because the tool is, by design, built to respond and adapt to user-commanded changes. This is the kind of capability the typical user won’t see in private-source OSes like Windows and iOS, especially because they have security as a concern (thus the OP’s motivation for the heads-up on security in Omarchy).
This is the main difference between sharing one’s cool config files and shipping a “distro”.
My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.
In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.
Fix it. If you see a problem in the world, fix it.
If they reject the fix, that's when you complain.
colesantiago•1h ago
Wouldn't the security team and the agents just go and fix the security holes?
They have a dedicated security team now that is being paid for this:
https://omarchy.org/security/
But having a dedicated security team is marketing?
I'm sure with the $10M cash chest the security will just improve over time and this blog post will be irrelevant.
I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
thehappyfellow•56m ago
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
Aurornis•56m ago
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
> I don't know, Omarchy's team really don't care if you're complaining.
Controversy is their primary marketing tactic. They prefer that people complain because being divisive and controversial is how DHH has always marketed his products.
brightball•55m ago
Why it’s security would be on a different level than any other Linux distro isn’t clear.
eviks•18m ago
MarkSweep•8m ago
The repo for reference:
https://github.com/basecamp/omarchy
shevy-java•54m ago
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.
orwin•29m ago