Am I going to hear about every insignificant development with Omarchy now because DHH ingratiated himself with a bunch of tech fascists?

I might get downvoted to hell and back for this, but can we stop talking about this piece of work distro? I don't think the project needs any more PR, period, it's what the loser who made it wants. Let the people who for some reason trust this collection of dotfiles and scripts do so in their own foolish bubble.

13M USD budget "distro" btw

Nazi Linux is going well

This is what happens when you let someone vibe code your distro's config

So opinionated.

Omarchy can no longer reliably determine the active Kitty tab/pane’s working directory via its socket

Imagine this as the reason to allow remote access without questions. I watched an interview and he is proud to fix those issues (there were a few more security issues of this stupidity class) and thinks this is totally normal. And over time after fix after fix, Omarchy will become secure. He admits Omarchy is unsecure at this time. Edit: I should probably link to the interview in question: Invidious or YouTube

The users are just beta testers, risking getting hacked. I could not trust this project. Even if all issues are fixed, who says no new security issues will make into the project? Omarchy is worse than Ubuntu and Manjaro combined.

Clearly the results of either being high on slop or a literal mass exploiter

The funny thing is I think windows does this. I may be wrong

This reminds me of the Docker issue they fixed in Omarchy recently. Basically you could get root through the docker socket, because the default user groups included the docker group.

In Kitty’s defense, the docs mention the risks involved with full remote control, and there several ways to control the scope of permitted actions.

It’s tricky though. I’d like my coding agent to be able to control the terminal, but I’ve found it harder to sandbox kitty than, say, a multiplexer like tmux/zellij. Herdr is a bit less obvious.

That does not allow remote code execution. An attacker still needs a vector like an SSH session to be able to control kitty. And at that point, if they already have a shell session, they don't need kitty to do damage.

edit: giving access to other programs is not remote execution, but obviously not a good default.