“Full of security holes" - and two examples in the article have been swiftly addressed, ignoring that there is a whole dedicated security team https://omarchy.org/teams/
What kind of blogging is this?
What kind of blogging is this?
Happy to explain: it's personal blogging, for writing down what's on my mind.
The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.
Also, the "full of security holes" is not my framing, someone else choose this submission title.
Of course, this is a culture war, but the point the blog post is making is that the Omarchy side is not exactly at the forefront of merit.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.
In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.
Fix it. If you see a problem in the world, fix it.
If they reject the fix, that's when you complain.
Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.
Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.
>> Fix it. If you see a problem in the world, fix it.
You can't "open a pull request" to fix a projects development process. The point of the article isn't about any specific security issue, it's that these vulnerabilities will keep getting introduced due to the lax attitude the project takes towards security.
Like a lot a lot a lot.
And that's before we had LLMs writing code. So really it's basically orbital now.
The fractional pennies in tokens it could have taken to fix this would cost less than their web traffic bill. But alas, if you fix it and put in a PR, that doesn't get you the eyeballs and social good-boy points that a blog post appealing to correct politics does.
Why fix when you can farm?
As I've gotten older and more experienced, I've really embraced the "just shut up and fix it" mentality. If you're empowered to do something, any time you spend complaining about it not being done is adding to the noise and a negative contribution.
This applies in life and in work. Especially in work. I straight up just shift the discussion or leave meetings if people start complaining about problems that are within their abilities to fix. It happens so much and I don't have time for it anymore.
And if you can fix it and you don't want to, just stfu and move on with your life. For the sake of all of us.