A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.
  • distal@lemmy.ml
    412·
    19 hours ago

    That’s fucking delicious. I am so not surprised that people who focus only on aesthetics (by that I mean those behind omarchy and hyprland) would fuck up the most basic things where substance has any importance. Aesthetics is for idiots! I will never want the Linux desktop to take over because of coolness, I want the software that attacks important questions to take over. These reactionaries have proven themselves to be utterly incompetent once again, and they will continue to prove their incompetence because they all lack insight and think of themselves as being god’s chosen ones.

    • dreamy (she/her)@lemmy.blahaj.zone
      3·
      11 hours ago

      My favourite WM has always been dwm. The default keybinds are absolutely awesome, and its default looks are just fine for me. Though it’s not really all that usable without patches/other suckless tools.

    • story@lemmy.zip
      81·
      16 hours ago

      this is why openBSD will run the spaceships 20000 years from now if we make it as a species

    • ghost_laptop@lemmy.ml
      24·
      8 hours ago

      why do you have to shit on hyprland? you could have the most boring aesthetic experience on earth but as far as i know this is an omarchy issue, hyprland doesn’t have any vulnerabilities, and it’s not just an aesthetic thing, you can do a lot of shit beyond simply aesthetic on hyprland. security and good looks are not mutually exclusive. and i dont think hyprland is here like “the thing” that will attract users. i don’t see new linux users using hyprland except in this case because it comes preconfigured, otherwise it’s for power users.

      • distal@lemmy.ml
        4·
        6 hours ago

        I am shitting on Hyprland because DHH, who is responsible for the mess that is Omarchy, is in bed with Vaxry and they both enable each other. I did not say that Hyprland has any vulnerabilities. I said that people who have a hard on for aesthetics do so because they are compensating for a lack of substance most often. I was specifically referring to this privilidge escalation fuck up.

        and i dont think hyprland is here like “the thing” that will attract users.

        Well, the attempt is made for it to be part of just that. See Omarchy.

        it’s for power users.

        Almost all programs that implement some sort of GUI the way XFCE or dwm does are for power users, it’s called being on Linux. The exception here is maybe the latest GNOME release. Hyprland is also for the r/UNIXPORN crowd.

    • d-RLY?@lemmy.ml
      4·
      16 hours ago

      Are there any hard forks or similar to Hyperland that are for Wayland? I was going to try it on my Pi5 (it is my main “messing with random Linux stuff” device that I don’t care if I break something), but then I saw people talking about the far-right/fascist stuff and didn’t bother. It looked nice when I saw people in random videos running it (wasn’t the focus of the videos and just stood-out).

      I know there are other well known tiled window managers which I might end up trying since I keep meaning to see how I take to them. The look of Hyperland is nice with some stacked window manager elements if needed (which I imagine other projects also have). I just don’t know which TWM projects are “better” (for starting with coming from only using SWM). Some level of aesthetics would be nice but am fine with adding after install.

      • communism@lemmy.ml
        3·
        5 hours ago

        Seconding Niri, but also I’ve seen swayfx setups that have Hyprland-like aesthetics.

        If you don’t care about fancy effects, I’ve been a river user for years and I like it. Nowadays it is just a compositor and the WM is separate, but river-classic (which includes a WM) has a dwm-like tag system, is programmatically configured (ie you speak to the river IPC in any language of your choosing—by default it’s a shell script but the WM just executes ~/.config/river/init on startup, so that file can be any executable), and is simple and lightweight. The new 0.4.x release separates the compositor and WM, so you can pick or write your own WM that suits your own workflow/use-case, if that’s your thing—it might not be if you don’t want customisability and you just want something that makes the decisions for you to a good enough standard.