Wouldn't the security team and the agents just go and fix the security holes?
They have a dedicated security team now that is being paid for this:
But having a dedicated security team is marketing?
I'm sure with the $10M cash chest the security will just improve over time and this blog post will be irrelevant.
I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
> I don't know, Omarchy's team really don't care if you're complaining.
Controversy is their primary marketing tactic. They prefer that people complain because being divisive and controversial is how DHH has always marketed his products.
Why it’s security would be on a different level than any other Linux distro isn’t clear.
The repo for reference:
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.