I'm somewhat out of the loop, and it's not really mentioned in the article, but what's with Omarchy getting this crazy amount of financial support from this list of fairly prominent individuals? Until a few weeks ago I'd never heard of it, then what I did hear is that it's being made by a very... uhh, eccentric(?) individual, and now it's suddenly got a crazy amount of funding. What am I missing?
That OSS has become too entangled with political activism and ideological gatekeeping, when it should be about making great software, giving people control over their computers, and rediscovering the joy of computing.
I don't think it's anti-political overall but it's more of an attempt to revive the enthusiast/hacker ethos of the OSS community.
"Freedom to compute" cannot be separated from "Freedom to exist" as it explicitly depends on it. The authors of Omarchy pay lip service to the former while taking a stance against the latter.
I'm very far from it but I saw many exchanges in my twitter timeline (because now when you click on a tweet to read it or interact, the algorithm thinks it's your only interest in life).
Do basically, they got 8 millions dollars of funding, they bragged and criticized others in linux and said some political stuff, they were also criticized by others including political stuff from the other side (not sure of the order). Finally it became viral enough for people looking at the security of the distro and found many issues.
Personally I like my Linux distro like my coffee: competently managed, with a minimum of drama and with having to hear the less assholes possible.
Just to explain because not everyone is necessarily a native English speaker or gets the reference.
This is a reference to a dog whistle. Above 25kHz are sounds that dogs can hear but humans generally can't.
The term dog whistle is used to refer to phrases that racists use to indicate their racism, while sounding plausibly deniable. The idea is that it's a phrase that will make other racists realize that you are one of them, while not sounding openly racist to others.
DHH himself has gone beyond dog whistles. He's directly compared what he considers undesirable ehtnic populations to wolves who need to be shot. He's just openly calling for ethnic cleansing by now.
But support for Omarchy itself can be seen as a dog whistle. It's widely known that DHH is a fascist, but you have some plausible deniability by donating to Omarchy because you're just politically neutral and think it's cool tech, or something like that.
Ugh, gosh really? I looked at one of the videos of the... eh excentric developer of the distro where he was presenting 4.0 and I was wondering about that retro neon design of background images he seemed to adore so much. I was wondering why someone would still think this Fashwave design to be cool. It's been what? 10 years when this trope peaked?
Of course it differs by the individual. I think there are three camps: Those who have read DHH's blog posts, and agree with them. Those who have read DHH's blog posts, but think "he couldn't possibly mean that". Those who haven't read DHH's blog posts, but know that he's on "their side" (right-leaning).
What about the people who have no idea who DHH is, what he stands for, and have heard about Omarchy for the first time just now and are trying to figure out what it even is and suddenly people are talking in circles about him being eccentric or problematic.
I switched to Omarchy 4.0 from CachyOS and is having an amazing experience so far, barely know anything about DHH other than that he made Rails, and now everybody is calling me a racist sympathizer.
You seem to be talking about users. They're talking about creators.
I don't think users know who DHH is, or care who DHH is. Probably like 0.01% of users have read a blog post, let alone a political one. (Maybe they all are, I haven't read any)
Just to provide some balance here to readers who have never heard of Omarchy before... this comment is totally cracked.
Yes, DHH has conservative political leanings, but the vast majority of people who have tried out Omarchy either don't know or don't care. The project is in no way consumed by politics. The commenter's brain obviously is, and they are seeing everything through that lens.
HN is better when the discourse doesn't revolve around reactionary political extremism. 99% of the energy going into the distro has always been people who liked to "rice" their Linux (make it look cool). If the project has a "soul" it's that. It's also a classic "hacker" thing to rice out your desktop. It's like the modern version of the demoscene. It's fine. It's cool. Sorry if someone hurt you. Now let's move past the political histrionics.
Thank you, this is exactly my experience with reporting on Omarchy. There is a small vocal group that is very determined to pull politics into it somehow, but to most (a more silent, big majority) this is not even known.
I.e., when Omarchy is reported on in my country (on local blogs) nobody ever replies with anything political, it's just about the tech. But in some circles this is very different, somehow.
Sadly true. I just felt the person I was quoting was waving it away as if it was a harmless irrelevance. But you’re right, appalling views have become mainstream.
I think there's such a strong difference between remigration and ethnic cleansing. And if you are misinformed, maybe take a minute to actually read his blog posts. But if you are and willingly misrepresenting his viewpoints, then maybe take a step back and think about what that says about you.
Not an endorsement of his viewpoints, but if we're going to debate people, we should do it on the actual words they say rather than the things we make up in our head about them.
The guy whose rallying cry blogpost for ethnonationalism (read: xenophobia) ends with comparing the presence of immigrants to the "blitz" bombing raids on London, as something to be "survived"? [1]
The same guy who followed that up by saying of an entire ethnic group he doesn't like that "When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation." [2]
The guy whose hope for society that don't involve ranting about how much he hates having other ethnicities around is that he believes "the will to power will return" [3] as the dominant force of society?
I dunno, maybe it's possible he isn't a fascist. But he coincidentally hates the same people the most famous fascists in history hated, and he proposes the same solutions they did.
I'm guessing taking a stance like the one below kind of does put you in the direction of more hardline perspectives:
> You have to act. You have to protect the sheep. Standing idly by while your livestock is devoured by predators or your neighborhood is taken over by migrants is a pathetic abdication of any functioning society's most basic duty to its citizens.
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation.
"When wolves get out of control, you shoot them. When gypsies take over public spaces you deport them" is how his last post ends. It's not even a dogwhistle anymore.
It's disappointing more than anything, I never agreed with him on everything but he was at least somewhat interesting/relevant to listen to at the peak of the RoR days and mostly harmless.
Mostly because HN is full of two kinds of things: tech bros that think that "everything shouldn't be political durr" and actual literal fascists that think that palantir is a good thing.
I'm not fully surprised by it. Pissing in their cornflakes and reminding everyone what they are is what matters, not points.
I mean, we can also expand with him being a xenophobic, great replacement conspiracy theorist, actively supporting racial hatred and violence dickwad if you want.
The "smear" you're mentioning is actually him smearing his shit all over the walls on his personal blog, and indeed, it reeks of fascism.
There's an implicit political statement in being able to write a simple one line hello world program and run it, using free software and information. Consider the counterfactual world where to even begin programming you have to pay for certification and training or specialized equipment/software. I know paid compilers, proprietary languages and closed specifications exist, but we can still just save print('hello world') to a file and run it using python which is freely available, or even better we can open devtools in our browser and jump into the console and run console.log('hello world') without even installing anything.
It’s a really strong UX that’s rapidly improving without a profit motive and people are excited about it.
Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.
Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.
One of many little quirks that no longer happen.
It’s nice to see excitement around Linux because nothing from the big names was really creating it.
I ran it daily like up to 4 months ago. Updates would regularly break hyprland and most games I wanted to play needed much more tinkering than on vanilla arch with the same dependencies installed.
> Closest thing to the “it just works” experience that Mac was always known for
I see this repeated a lot, but the people I know who tried Omarchy were always fixing something or dealing with breakage from an update.
The best argument I’ve heard for Omarchy that is actually consistent with what I’ve observed is that it ships with cool looking default configs for everything that make it feel fun to use.
The belief that everything just works seems more like a belief perpetuated by the messaging push behind it. Every time real issues pop up they get explained away as being due to someone’s local config changes or forgiven because it’s a young project. Even in this thread there are dozens of comments downplaying security issues as not a problem because they will get fixed, which is a symptom of a project where the messaging has gotten ahead of the facts.
The main case for Omarchy to me is the OOTB experience, which is more "good to go" than pretty much any other distro, also the hotkeys and config setup are both power user friendly. You are correct that updates have had brick-risk, though I think they've gotten better. I prefer some elements of plasma to the hyprland setup, but agents are very good at making config changes, it's much faster than navigating menus or finding lines in a config file (human work time, maybe not wall clock time).
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
He would have had better success by literally prompting his agents to copy Apples desktop environment.
Are all the updates still handled by clobbering bash scripts?
Last time I looked into it, the technical approach was equivalent to throwing a bunch of things at a gas fire. It's just a pre-configured arch install that introduces a metric ton of tech debt.
First time huh? They already have investors (called "patrons" so far). OpenAI shown the non-profit status can be used to jump start for-profit ventures, I'm sure everyone involved here studied closely exactly how Altman pulled it off.
omarchy is the new "i use arch, btw".
I'm too altruistic (or dumb) to understand why you would pump money into a riced arch install.
In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.
I don't think it's aimed at them. I think it's mostly aimed at windows and mac users who are computer enthusiasts but never really made the jump to Linux as a desktop daily driver. Just supposed to be a cool on-ramp - basically mint but different and with some marketing behind it?
Then why chose a distro that is being maintained by one person. I would NEVER recommend a Windows/Mac and first time Linux user to switch to such a distro. Not just his political views no quite practical implications are key here: what if this guy has a heart-attack? The distro will be abandoned. What if his development PC gets compromised? The distro is fried in both cases. The more developers are on the team holding the credentials and responsibilities the better, the safer a distro is. Omarchy is nothing more than an experimental distro and shouldn't be used productively or as your main OS. Simply because it's run by one guy, one single point of failure.
It's the same reason why you mustn't recommend CachyOS to newcomers either, they're still just two people running the show, although they're aware of the risks that comes with it and trying to expand their core team.
I wasn't making a value judgement on who should respond to the offer, just commenting on who the offer was probably aimed at. Though I do think the sudden spike in investment and the little foundation around it now means probably more than "just one guy".
The promise of the so-called ‘malleable computer’:
a machine whose hardware parts you could change, as well as bigger chunks of its software, above and beyond end-user apps. That is possible via the integration of the OS with AI agents that do the heavy lifting for you in adapting the OS to your ‘needs.’ Users of the Pi coding agent get a better feeling for this because the tool is, by design, built to respond and adapt to user-commanded changes. This is the kind of capability the typical user won’t see in private-source OSes like Windows and iOS, especially because they have security as a concern (thus the OP’s motivation for the heads-up on security in Omarchy).
I'm surprised HN failed to mention the real reason in this thread. It's AI. The goal of the project is to have users build (fix, maintain, expand etc) the distro themselves through AI generated (bug) reports which are then picked up by AI, solved, tested and published in a new release. A full AI loop.
AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.
Been hearing about Omarchy for a while (past half a year if not more), but pretty much exclusively on LinkedIn. I don't remember if I follow DHH but I suppose enough of my connections do either way that I often get recommended posts about Omarchy. But I barely hear about it on reddit and I probably saw it mentioned a couple times here on HN
That the future is (by some) considered to be about “personal branding” rather than actual engineering. Build a cult of followers and ship them whatever.
This is the main difference between sharing one’s cool config files and shipping a “distro”.
It's AI and dev forward in a brilliant way. It ships with its own skill [1], so
agents actually work way better out of the box than on other distros.
Something crashes? Click the notification and your agent solves the bug.
It also has a very standardized UI library and a good plugin system.
Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.
Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.
it's amazing from a historical perspective that there are HNers around now who don't know who DHH is, when he was such a prevailing voice in the HN scene back in the day.
He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.
I have trouble imagining it. The early rails community was very welcoming at the time. The things he now openly states were simply not welcome in most polite society at the time.
I'm not sure DHH really held the same views back then, either. The "Overton Window" has moved over the last 20 years so openly bigoted and racist views are accepted in the discourse now.
Marc Andreessen helped establish the modern web browser, he has always been an Ayn Rand fan for example. But politics wasn't that important back then, I guess? And I just think there simply were not a lot of opportunities to gain some political and financial capital from voicing their fringe believes for people like them back in the day. They were busy building systems and software, now they are busy building or changing political systems.
DHH effect. He has a very strong following, and there's a certain amount of trust/prestige attached to his name in the tech/startup world. For a lot of these people, DHH building something is probably enough to get them interested and willing to throw money at it.
Why? I watched all of the supposed controversies around him happen in real time and they were all non stories.
“Hey, you can be political on social media but don’t bring it into our work chats. We are here to do a job. If that is a problem, here’s a generous 6 month severance package.”
That was what politically blew him up and he was unwilling to apologize for a completely reasonable take.
Now he’s giving his time and money freely to make a great Linux distro.
It says more about the anti-DHH crowd than it does about him.
> Because the sacred cow here is not just that mass migration must stop going forward. It's also that millions who are already in Europe must go.
He's suggesting we round up all the brown people and deport them... (He's smart enough to not put it in those words but I don't see what else it could mean.)
I wonder if that will change now he's gone from edgy opinions that rile up woke people (e.g. immigration is too high in the UK) to actually advocating ethnic cleansing (not the murdery kind but still...).
It's always the same give these people enough prestige and power that they feel untouchable and their true nature comes to the surface. No more dogwhistling needed he thinks, I have powerful wealthy backers and their lawyers now.
Just like anything in tech recently, make a halo effect around whatever, over sell it, try to make a fanbase, and some connections here and there, and you got your meme product into a multi million product. It’s sad, there are dozens of better distributions out there and been in the game for years that deserve more exposure, but oh well.
isn't it a typical SV investor money hype train situation:
- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)
- project jumps on some hype train (e.g. AI)
- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold
- owner also goes with the "move fast break things"
- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.
- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)
So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.
It's a shame because DHH seems to be going fully agentic (or at least that's his public stance), so no idea why he isn't rolling a proper distro. Looking at his repo it's just pure shell scripts (why?) and using prebuilt software. He could have rolled a custom renderer + pipeline + other software needed to make a distro work (ie a modern KDE).
Go ahead and do it. Would love to see an improved Linux rewritten with agents. My personal belief is it would take a long time, lots of money and much human intervention/guidance but if you think they’re capable alone just do it this afternoon and see how it goes.
It is going to be marketed to the AI bros. Possibly to Shopify customers as an "advanced AI distro" to create shops with. The openclaw guy just sponsored Omarchy.
It's a vibe coding distro, so of course there is no security to begin with.
DHH is also on the Slopify board, so AI is mandatory.
Just DHH being loud about it, getting his billionaire friends to join, and their usual tech-bro following astroturfing it (they somehow see it as a culture war thing to fight against the oppression from other distros and FLOSS projects that have code of conducts and don’t want to work with racists)
I think there is a pretty decent swath of people willing to rally behind someone who says they are trying to make a cool project specifically for people who want to be away from the "insufferable injection of identity politics". How large that swath is relative to the other is up for debate but it doesn't have to be particularly large. You'll get funding from people who are both interested in the actual product AND the posture, some from people who are just into the posture, and some who are just into the product. Ditto with interest from people to try it and or contribute time to it's development.
This. The alt right in German speaking countries are calling themselves "Identitäre", which was inspired by French Les Identitaires. For all their criticism of what once was just a niche and fringe academic leftist movement, they are hypocritically are mirroring at least mirroring it if not more so. I believe they have actually helped progressive identity politics become mainstream as a reaction to their attacks on minorities, as a reaction to their hatred the mainstream has signaled their solidarity with minority identities, this is the main reason for Rainbow flags, to show solidarity against hatred.
The two linked issues are for the same bug report.
A friend has been urging me to install Omarchy for months. I’ve finally caved in after a horrible experience with highly-praised CachyOS.
All I can say is, I understand the hype. It works. The install is uncomplicated, no selecting from five legacy bootloaders, choosing versions or selecting a window manager. The tiled window manager works pretty much how I already use Mac. I like the terminal-focused system tools. Installing software is easy and lightning-fast.
It was (my) main takeaway and I wanted it to be evident in the headline. I didn’t want to bury the lede; I’ll uneditorialize it because it seems it’s causing some fighting in the comments and I don’t really want to instigate anything, more just warn people using the distro. I don’t think it’ll reach the people who need to be warned if it’s not evident that there’s an issue from the start.
Appreciate it! Editorialised is fine but the post is mostly about the development practices leading to bugs & the lack of awareness of how dangerous that is, not about the current absolute number of security holes if that makes sense.
Isn't the rise of AI basically turning software engineering into tumblr? Thats what I see; soon we'll have a forum that's just filled with roblox-but-for-adults.
A bunch of terminally online people have decided to make stalking DHH into a personality/lifestyle. This blog is incorrectly titled, because it doesn't talk about security holes at all.
edit: I don't care what people decide to do with their linux distro that I'm probably never going to use. I suggest you try Debian.
I think I would argue that linking to the security problem(s) and then writing about their style and how they probably came to be counts as discussion, but to each their own.
Apparently the Omarchy plugin ecosystem is also a free for all like the Arch AUR, except the audience includes people who are new to Linux and less likely to understand the risks.
A lot of plugin systems are like that. (See the hyprland, noctalia, or vim/neovim's plugin systems).
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
Obviously every single loaded take on this distro has already been taken, on this thread alone. So there is little anybody can add to it... all I would say is that no publicity is bad publicity and if that's the intention, then well done.
I am happy that the Linux ecosystem is getting attention, traction and funding. People that dont like and want to choose to go die on another hill, so be it, their prerogative.
DHH has a large following, so do many people in this network. His blog posts are often discussed here, it's not really surprising that it gets attention and you don't need secret astroturfing or sneaky marketing if people just share / interact with it themselves organically.
Just hype, it's Kagi all over again. People said the same thing there, we're just too cynical, not used to people getting excited about really cool stuff anymore.
They just announced the new "Omacom foundation" last Friday, with $8 million of funding from prominent tech people. That's why it's getting current flurry of attention
It's been showing up all over YT for a while if you do any searches for Linux.
I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.
There is this meme of a bell curve where the left side is some newbie trying to do something obvious, the right side is a "pro" trying to do the same obvious thing, and the middle is a someone trying to do cool/new/trendy stuff.
The left side us Ubuntu/Fedora. The right side is Arch. The middle is all these tech-fluencer-wanna-bes custom-made-ai-enhanced distros.
Your left side of the curve is missing people like me who use Fedora.
Been using Linux since 1997, it's been my primary OS since ~2003 (except for gaming and Microsoft seem determine to end their streak on that one) and I use Fedora because I really don't care that much, it's a reliable tool, it has recent packages and I like that it's semi-rolling in that it's a straight forward update every 6ish months.
I had my "I must customise and control every single part of my Linux install" phase early (Slackware and Gentoo et al) and then I realised I didn't actually care all that much, give me sane defaults with the ability to tweak if I want to and stability, I'm at the point where "If I have to think much about my OS it's failed in doing what I want" holds.
If they're going agentic and using the stack that they're using (qt/shell scripts?) they'll never patch it in full, if ever. The thing is almost certainly full of injection/forgery attacks, on top of being bloated to oblivion.
Isn't most of the security holes still there if used arch and installed the packages yourself. A lot of people complained ssh had security issues in omarchy because it used the default settings. That would still be the same on arch?
heh... i still remember the very first time when it came out with it's opinionated branding and all that, looked good and went ahead to try it out but was so annoyed with all the bloats and promoting their software's in it which made me their intentions already clear. I got to know that recently they've added option to remove all the bloats but IDC anymore. not gonna try that ever. Not to mention it was just dotfiles painted on top of arch iso and documentation itself included archinstall guides - if that's a distro then my system with dotfiles are a distro in itself lol... though it looks like they've changed things up now, it looks like it has a iso's and all the stuffs to be called a distro now.
Not following Omarchy, not even sure what it is trying to be compared to existing distros (other than an incredibly hyped up product). Not hating on DHH. But hasn't he become famous for developing a web framework (20 years ago), rather than for his technical prowess as a systems-level engineer? Seeing these kinds of bugs is not exactly unexpected.
Hey and Basecamp suck. Basic features like search barely work, the iOS and Android apps are embarrassingly bad, and the UI looks like it was designed for Netscape Navigator 4. With Rails, dhh spent years trying to work around JavaScript , leaving the framework increasingly difficult to recommend in 2026. Why on earth would you trust him with your OS ? Even if you share his politics, you deserve better software.
“Full of security holes" - and two examples in the article have been swiftly addressed, ignoring that there is a whole dedicated security team https://omarchy.org/teams/
Happy to explain: it's personal blogging, for writing down what's on my mind.
The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.
Also, the "full of security holes" is not my framing, someone else choose this submission title.
The same kind as a similar recent post [1] where a person pointed out a bunch of problems with Omarchy's shell scripts as examples of it being terrible.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.
In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.
Because you could make the world a better place instead of just complaining about it? I don't understand the "all I wanna do is complain" process at all.
Fix it. If you see a problem in the world, fix it.
I do t just complain. I making the world a better place in ways which I believe are worth it.
Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.
Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.
There's a difference between a few small bugs because software is new and a half dozen eval(untrusted_input) in version 4.0.
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
> Wouldn't the security team and the agents just go and fix the security holes?
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
> I don't know, Omarchy's team really don't care if you're complaining.
Controversy is their primary marketing tactic. They prefer that people complain because being divisive and controversial is how DHH has always marketed his products.
Yea, I don’t get the shade. As many have said, it’s just Arch + a very polished UX preconfigured so you can jump right in without a lot of setup overhead.
Why it’s security would be on a different level than any other Linux distro isn’t clear.
It’s a bit more than Arch. There are a bunch of programs written in shell and QML/JavaScript. I guess at least they are using memory-safe languages, but shell scripts make it easier to write the type of shell-injection bug mentioned in the article. Personally if I started a new project in 2026, I would not choose bash and vanilla JavaScript as the languages to write it in.
If they are interested in complaints. Probably they do not, so people write blogs on their own. This kind of also happened in the rails world; some people got upset at DHH and then started writing complaints; and many of these complaints are by themselves also total garbage (some are more objective criticism, these tend to be better). It's kind of agenda-based everywhere.
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.
It is probably true that it has a big attack surface. But omarchy is no doubt a huge driving force. A few days ago I listened to a podcast dhh talking about the latest major release and its huge donation. I believe it’s now 10m usd or something. I am hopeful that dhh is serious enough to address the security issues plus a lot of ux improvement on linux.
In the episode he emphasized 17 layers of security layers where I remember the number solely because I found hard to believe to be honest.
Look - I'm am the opposite of DHH fan -- that said -- they could fix all these bugs/security issues that same way they created them. It makes sense to some extent to create a product that emphasized what is different about it from a feature/UX perspective so people can consider if it would even be useful to them at all. If they can prove that they have created something useful - then they can fix all these issues. Fixing these issues is not hard. Creating a useful product that people want -- this is the hard part.
The "real world" is long term results. Yes, this is a joke amount of money for building an OS if the goal is conquering desktops and holding the territory. It is obvious to everyone the "Year of the Linux Desktop" attitude with only $10M in funding isn't going to end the way they want.
At this point, it looks like some here in the Linux community have a new found hobby of actually liking to get angry at things instead of building now that AI took away their identity.
This is just a person having fun building their own distro. If you don't like it why are you giving them so attention even though you will never use it?
Using bash for all this stuff is like trying to wash your car with sandpaper instead of soap and water. Yes it can work if you're really careful with it, but in practice no
Just read DHH's blog and then you may quickly realise that
other distributions may be a better choice. There is a
difference between "opinionated" and ... whatever the content
criteria is for DHH nowadays to write stuff on his blog.
Younger DHH was more impressive than the TechBro aged later
variant, in my personal opinion.
Arch is in general a good base though - I mostly use Manjaro
as base, then customize it via a ton of scripts and compile
about 99% from source anyway, using an extended set of ruby
scripts (a bit similar to homebrew, but one big difference is
that I wanted versioned AppDirs like in GoboLinux; my scripts
originated from GoboLinux's philosophy since I did not want
to use shell scripts but retain versioned AppDirs. Manjaro
is in some ways a bit similar to oldschool slackware, which
unfortunately kind of died - it is not really fully dead,
but look at the homepage and then tell me how many years
past the last .iso release still counts as alive. So to me
it is dead, despite the changelogs still being updated or
others, such as alienbob, pushing out new releases.)
I'm somewhat out of the loop, and it's not really mentioned in the article, but what's with Omarchy getting this crazy amount of financial support from this list of fairly prominent individuals? Until a few weeks ago I'd never heard of it, then what I did hear is that it's being made by a very... uhh, eccentric(?) individual, and now it's suddenly got a crazy amount of funding. What am I missing?
It's a political statement disguised as a FOSS project (which itself is fine, all software is political).
The funders are not funding the development of a Linux distro, they are co-signing the political statement.
Is it? What's the statement?
That OSS has become too entangled with political activism and ideological gatekeeping, when it should be about making great software, giving people control over their computers, and rediscovering the joy of computing.
I don't think it's anti-political overall but it's more of an attempt to revive the enthusiast/hacker ethos of the OSS community.
"Freedom to compute" cannot be separated from "Freedom to exist" as it explicitly depends on it. The authors of Omarchy pay lip service to the former while taking a stance against the latter.
You're repeating fake news. Link to where DHH specifically takes a stand against the "freedom to exist."
See links further down: https://news.ycombinator.com/item?id=49448069
And to get people to ignore that DHH is a massive racist.
Not sure ignore is the right word here. I think they rather take pride in it.
I'm very far from it but I saw many exchanges in my twitter timeline (because now when you click on a tweet to read it or interact, the algorithm thinks it's your only interest in life).
Do basically, they got 8 millions dollars of funding, they bragged and criticized others in linux and said some political stuff, they were also criticized by others including political stuff from the other side (not sure of the order). Finally it became viral enough for people looking at the security of the distro and found many issues.
Personally I like my Linux distro like my coffee: competently managed, with a minimum of drama and with having to hear the less assholes possible.
It's quite a loud one, but it's broadcast above 25KHz or so
wut? haha
Beyond human hearing for a whistle but within the frequency a dog can hear a whistle, i.e. a slightly tongue in cheek way to call it a dog whistle.
Just to explain because not everyone is necessarily a native English speaker or gets the reference.
This is a reference to a dog whistle. Above 25kHz are sounds that dogs can hear but humans generally can't.
The term dog whistle is used to refer to phrases that racists use to indicate their racism, while sounding plausibly deniable. The idea is that it's a phrase that will make other racists realize that you are one of them, while not sounding openly racist to others.
DHH himself has gone beyond dog whistles. He's directly compared what he considers undesirable ehtnic populations to wolves who need to be shot. He's just openly calling for ethnic cleansing by now.
But support for Omarchy itself can be seen as a dog whistle. It's widely known that DHH is a fascist, but you have some plausible deniability by donating to Omarchy because you're just politically neutral and think it's cool tech, or something like that.
"Linux has been infected by le woke mob and we're making it Great Again"
Ugh, gosh really? I looked at one of the videos of the... eh excentric developer of the distro where he was presenting 4.0 and I was wondering about that retro neon design of background images he seemed to adore so much. I was wondering why someone would still think this Fashwave design to be cool. It's been what? 10 years when this trope peaked?
Of course it differs by the individual. I think there are three camps: Those who have read DHH's blog posts, and agree with them. Those who have read DHH's blog posts, but think "he couldn't possibly mean that". Those who haven't read DHH's blog posts, but know that he's on "their side" (right-leaning).
What about the people who have no idea who DHH is, what he stands for, and have heard about Omarchy for the first time just now and are trying to figure out what it even is and suddenly people are talking in circles about him being eccentric or problematic.
Yeah, this is so annoying.
I switched to Omarchy 4.0 from CachyOS and is having an amazing experience so far, barely know anything about DHH other than that he made Rails, and now everybody is calling me a racist sympathizer.
You seem to be talking about users. They're talking about creators.
I don't think users know who DHH is, or care who DHH is. Probably like 0.01% of users have read a blog post, let alone a political one. (Maybe they all are, I haven't read any)
Just to provide some balance here to readers who have never heard of Omarchy before... this comment is totally cracked.
Yes, DHH has conservative political leanings, but the vast majority of people who have tried out Omarchy either don't know or don't care. The project is in no way consumed by politics. The commenter's brain obviously is, and they are seeing everything through that lens.
HN is better when the discourse doesn't revolve around reactionary political extremism. 99% of the energy going into the distro has always been people who liked to "rice" their Linux (make it look cool). If the project has a "soul" it's that. It's also a classic "hacker" thing to rice out your desktop. It's like the modern version of the demoscene. It's fine. It's cool. Sorry if someone hurt you. Now let's move past the political histrionics.
Thank you, this is exactly my experience with reporting on Omarchy. There is a small vocal group that is very determined to pull politics into it somehow, but to most (a more silent, big majority) this is not even known.
I.e., when Omarchy is reported on in my country (on local blogs) nobody ever replies with anything political, it's just about the tech. But in some circles this is very different, somehow.
"political histrionics" is an interesting way to refer to calling for ethnic cleansing
“Europe was better when it was more white” isn’t “conservative leanings”
unfortunately the current conservatives in the US do seem to align with those views
Sadly true. I just felt the person I was quoting was waving it away as if it was a harmless irrelevance. But you’re right, appalling views have become mainstream.
>DHH has conservative political leanings
to be clear to those readers seeking balance, this is putting it mildly.
> The funders are not funding the development of a Linux distro, they are co-signing the political statement.
It's not even a Linux distro. It's an Arch respin with tweaks that DHH likes.
This is for people who want to work like DHH.
... a political statement led by a fascist agitator and financed to the tune of $8 million.
Financed by controversial figures too
I'm so disappointed that The Standup was platforming him.
that's when I unsubscribed
Care to elaborate on "fascist agitator" or are you just going to smear a person with a truly serious epithet without anything to back it up?
He literally calls openly for the ethnic cleansing of undesirable populations from Europe. Just read his blog. There's no subtlety or nuance.
[delayed]
I think there's such a strong difference between remigration and ethnic cleansing. And if you are misinformed, maybe take a minute to actually read his blog posts. But if you are and willingly misrepresenting his viewpoints, then maybe take a step back and think about what that says about you.
Not an endorsement of his viewpoints, but if we're going to debate people, we should do it on the actual words they say rather than the things we make up in our head about them.
>maybe take a minute to actually read his blog posts.
a great place to start is the one where he compares the Roma (of course, he chooses the more offensive term) to wolves that should be shot.
"When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them."
>I think there's such a strong difference between remigration and ethnic cleansing
you can think what you want to think but this is definitionally incorrect
ethnic cleansing?
@ngcazz can't realy directly due to nesting limit but:
I don't think most people have read the blog.
I don't think you can assume people have read anything outside the specific page linked by HN.
The guy whose rallying cry blogpost for ethnonationalism (read: xenophobia) ends with comparing the presence of immigrants to the "blitz" bombing raids on London, as something to be "survived"? [1]
The same guy who followed that up by saying of an entire ethnic group he doesn't like that "When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation." [2]
The guy whose hope for society that don't involve ranting about how much he hates having other ethnicities around is that he believes "the will to power will return" [3] as the dominant force of society?
I dunno, maybe it's possible he isn't a fascist. But he coincidentally hates the same people the most famous fascists in history hated, and he proposes the same solutions they did.
[1] https://world.hey.com/dhh/as-i-remember-london-e7d38e64
[2] https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
[3] https://world.hey.com/dhh/the-will-to-power-will-return-58ff...
https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug...
Even before I read this blog post only the way he behaved on The Standup made me suspicious, raised some red flags.
I'm guessing taking a stance like the one below kind of does put you in the direction of more hardline perspectives:
> You have to act. You have to protect the sheep. Standing idly by while your livestock is devoured by predators or your neighborhood is taken over by migrants is a pathetic abdication of any functioning society's most basic duty to its citizens.
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation.
If you, having read his blog, are going to say that, then you're either epically naive, or you're deliberately whitewashing his messaging.
The OP could well be referring to DHH's recent blog post comparing Roma in Copenhagen to a predatory species that needed to be culled.
I thought he was referring to his "London that I used to know" posts, wasn't aware he'd been at it again.
"When wolves get out of control, you shoot them. When gypsies take over public spaces you deport them" is how his last post ends. It's not even a dogwhistle anymore.
It's disappointing more than anything, I never agreed with him on everything but he was at least somewhat interesting/relevant to listen to at the peak of the RoR days and mostly harmless.
Not sure why you are getting downvoted. His post literally ends with those words: https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
Mostly because HN is full of two kinds of things: tech bros that think that "everything shouldn't be political durr" and actual literal fascists that think that palantir is a good thing.
I'm not fully surprised by it. Pissing in their cornflakes and reminding everyone what they are is what matters, not points.
I mean, we can also expand with him being a xenophobic, great replacement conspiracy theorist, actively supporting racial hatred and violence dickwad if you want.
The "smear" you're mentioning is actually him smearing his shit all over the walls on his personal blog, and indeed, it reeks of fascism.
You're out of touch. This is common and unsurprising knowledge. He does hold explicitly fascist political views; it's not nuanced.
>He does hold explicitly fascist political views; it's not nuanced.
No he doesn't. You're inadvertently right, it's not nuanced: he's not a fascist.
> It's a political statement disguised as a FOSS project (which itself is fine, all software is political).
So a "hello world" program is now political?
I think you just want to purposefully find a reason to be angry and you love it.
>So a "hello world" program is now political?
There's an implicit political statement in being able to write a simple one line hello world program and run it, using free software and information. Consider the counterfactual world where to even begin programming you have to pay for certification and training or specialized equipment/software. I know paid compilers, proprietary languages and closed specifications exist, but we can still just save print('hello world') to a file and run it using python which is freely available, or even better we can open devtools in our browser and jump into the console and run console.log('hello world') without even installing anything.
> I think you just want to purposefully find a reason to be angry
Irony is dead.
You’re deliberately bringing up irrelevant minimal counter examples in bad faith.
A minimal counterexample is a valid proof.
https://en.wikipedia.org/wiki/Minimal_counterexample
Please don't make personal attacks on other posters.
Then you should be able to say where the political statement in omarchy resides, and what it is
"all software is political" is a textbook deepity: https://rationalwiki.org/wiki/Deepity
It’s a really strong UX that’s rapidly improving without a profit motive and people are excited about it.
Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
I was running i3 when an Ubuntu update borked my entire setup so I made the switch. The difference is night and day in the level of polish.
Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth headset because Zoom bypassed the main notification system. Issue resolved here.
One of many little quirks that no longer happen.
It’s nice to see excitement around Linux because nothing from the big names was really creating it.
I ran it daily like up to 4 months ago. Updates would regularly break hyprland and most games I wanted to play needed much more tinkering than on vanilla arch with the same dependencies installed.
I haven’t tried installing games on Linux in years, so that’s a gap for my experience.
Mostly you install steam, install game from inside steam, and it just works with nothing further.
A far cry from 15 years ago.
I've run it since launch without issue. That is: to each their own really
Not really: as far as we know, you use it for nothing; the person you replied to gave examples.
> Closest thing to the “it just works” experience that Mac was always known for
I see this repeated a lot, but the people I know who tried Omarchy were always fixing something or dealing with breakage from an update.
The best argument I’ve heard for Omarchy that is actually consistent with what I’ve observed is that it ships with cool looking default configs for everything that make it feel fun to use.
The belief that everything just works seems more like a belief perpetuated by the messaging push behind it. Every time real issues pop up they get explained away as being due to someone’s local config changes or forgiven because it’s a young project. Even in this thread there are dozens of comments downplaying security issues as not a problem because they will get fixed, which is a symptom of a project where the messaging has gotten ahead of the facts.
The main case for Omarchy to me is the OOTB experience, which is more "good to go" than pretty much any other distro, also the hotkeys and config setup are both power user friendly. You are correct that updates have had brick-risk, though I think they've gotten better. I prefer some elements of plasma to the hyprland setup, but agents are very good at making config changes, it's much faster than navigating menus or finding lines in a config file (human work time, maybe not wall clock time).
> always fixing something or dealing with breakage from an update.
literally the experience that Mac was always known for
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware. Even goes so far as to optimize the install time down to about 1 minute.
He would have had better success by literally prompting his agents to copy Apples desktop environment.
Are all the updates still handled by clobbering bash scripts?
Last time I looked into it, the technical approach was equivalent to throwing a bunch of things at a gas fire. It's just a pre-configured arch install that introduces a metric ton of tech debt.
It's a slop-linux with a racism-linux hat on.
> without a profit motive
First time huh? They already have investors (called "patrons" so far). OpenAI shown the non-profit status can be used to jump start for-profit ventures, I'm sure everyone involved here studied closely exactly how Altman pulled it off.
> It’s a really strong UX that’s rapidly improving without a profit motive and people are excited about it.
/r/unixporn is all about that. They don't get a $10 million fund though.
> Closest thing to the “it just works” experience that Mac was always known for and it runs great on older hardware.
Ubuntu. Debian. Fedora especiall via Bazzite. Arch via CachyOS.
> Small example, running Zoom on i3 caused a tile cascade every time I turned on my Bluetooth
Small example: many Steam games were dog slow or unplayable in Omarchy. I switched to CachyOS, all issues were gone.
> It’s nice to see excitement around Linux because nothing from the big names was really creating it.
None of the big names are creating anything in Omarchy. It's a bunch of vibe-coded dotfiles and shell scripts. It's hype around ricing.
Comparing Wayland anything to OSX-tier "it just works" is bizzaro-world-tier delusion.
Looks like nothing. It's arch with a bunch of pre installed apps and a few goodies on top.
My guess is relationships and fame went a long way towards getting those funds.
omarchy is the new "i use arch, btw". I'm too altruistic (or dumb) to understand why you would pump money into a riced arch install.
In some way I feel people just try to buy into "street cred" on the other hand omarchy could be a great launchpad for a distro that is customizable, easy enough to use and may provide a great MDM solution at some point.
What mean rice in this context ?
> omarchy is the new "i use arch, btw"
More like “I'm a white suppremacist, btw” though.
Quite unfortunate that it became acceptable enough to brag about that in public.
im pretty sure arch users dont want to associate with ormachy :))
I don't think it's aimed at them. I think it's mostly aimed at windows and mac users who are computer enthusiasts but never really made the jump to Linux as a desktop daily driver. Just supposed to be a cool on-ramp - basically mint but different and with some marketing behind it?
Then why chose a distro that is being maintained by one person. I would NEVER recommend a Windows/Mac and first time Linux user to switch to such a distro. Not just his political views no quite practical implications are key here: what if this guy has a heart-attack? The distro will be abandoned. What if his development PC gets compromised? The distro is fried in both cases. The more developers are on the team holding the credentials and responsibilities the better, the safer a distro is. Omarchy is nothing more than an experimental distro and shouldn't be used productively or as your main OS. Simply because it's run by one guy, one single point of failure.
It's the same reason why you mustn't recommend CachyOS to newcomers either, they're still just two people running the show, although they're aware of the risks that comes with it and trying to expand their core team.
I wasn't making a value judgement on who should respond to the offer, just commenting on who the offer was probably aimed at. Though I do think the sudden spike in investment and the little foundation around it now means probably more than "just one guy".
The promise of the so-called ‘malleable computer’:
a machine whose hardware parts you could change, as well as bigger chunks of its software, above and beyond end-user apps. That is possible via the integration of the OS with AI agents that do the heavy lifting for you in adapting the OS to your ‘needs.’ Users of the Pi coding agent get a better feeling for this because the tool is, by design, built to respond and adapt to user-commanded changes. This is the kind of capability the typical user won’t see in private-source OSes like Windows and iOS, especially because they have security as a concern (thus the OP’s motivation for the heads-up on security in Omarchy).
I'm surprised HN failed to mention the real reason in this thread. It's AI. The goal of the project is to have users build (fix, maintain, expand etc) the distro themselves through AI generated (bug) reports which are then picked up by AI, solved, tested and published in a new release. A full AI loop.
AI sells, this should be obvious by now. The guy behind the project talks about this in more detail, for instance during the interview he recently did with Network Chuck on youtube.
Been hearing about Omarchy for a while (past half a year if not more), but pretty much exclusively on LinkedIn. I don't remember if I follow DHH but I suppose enough of my connections do either way that I often get recommended posts about Omarchy. But I barely hear about it on reddit and I probably saw it mentioned a couple times here on HN
That the future is (by some) considered to be about “personal branding” rather than actual engineering. Build a cult of followers and ship them whatever.
This is the main difference between sharing one’s cool config files and shipping a “distro”.
It's AI and dev forward in a brilliant way. It ships with its own skill [1], so agents actually work way better out of the box than on other distros.
Something crashes? Click the notification and your agent solves the bug.
It also has a very standardized UI library and a good plugin system.
Due to those things the list of plugins is increasing by hundreds a day [2], I made one that adds Exposé like for macOS myself a few days ago.
Most of them are actually good, and unlike other distros they look visually consistent. Customizing your system and participating in the community has never been this easy. Incredibly fun, feels like being a kid in a candyshop.
[1] https://github.com/basecamp/omarchy/blob/quattro/default/age...
[2] https://omarchyplugins.com/
it's amazing from a historical perspective that there are HNers around now who don't know who DHH is, when he was such a prevailing voice in the HN scene back in the day.
He is the author of rails and there are so many founders who were inspired by 37 signals and their takes on things back in the day.
The golden years of HN.
Would have rails taken off if he was equally open about his politics back then?
It's impossible to know what his politics was back then in fairness.
People's politics do often (but not always) change as they age.
Yes, people were more mentally resilient and mature then and it was pre Reddit, which has completely broken and warped many people’s minds.
It started in the early 2000s. Politics hadn't shifted left enough to make him right-wing back then.
I have trouble imagining it. The early rails community was very welcoming at the time. The things he now openly states were simply not welcome in most polite society at the time.
I'm not sure DHH really held the same views back then, either. The "Overton Window" has moved over the last 20 years so openly bigoted and racist views are accepted in the discourse now.
Marc Andreessen helped establish the modern web browser, he has always been an Ayn Rand fan for example. But politics wasn't that important back then, I guess? And I just think there simply were not a lot of opportunities to gain some political and financial capital from voicing their fringe believes for people like them back in the day. They were busy building systems and software, now they are busy building or changing political systems.
Just billionaires people giving money to a friend's project.
It's being largely driven by DHH (creator of Rails, and co-founder of 37signals). He has a massive following and a lot of influence (and money).
DHH effect. He has a very strong following, and there's a certain amount of trust/prestige attached to his name in the tech/startup world. For a lot of these people, DHH building something is probably enough to get them interested and willing to throw money at it.
Among some, for others (including me) him been attached to it is very much a counter signal.
Why? I watched all of the supposed controversies around him happen in real time and they were all non stories.
“Hey, you can be political on social media but don’t bring it into our work chats. We are here to do a job. If that is a problem, here’s a generous 6 month severance package.”
That was what politically blew him up and he was unwilling to apologize for a completely reasonable take.
Now he’s giving his time and money freely to make a great Linux distro.
It says more about the anti-DHH crowd than it does about him.
You're skipping his recent blog posts; I think that's where the bulk of people's complaints come from. See for example https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...
I agree about most of what he's said (e.g. "The London I remember" is totally inaccurate but not actually offensive), but did you see this?
https://world.hey.com/dhh/three-sacred-cows-that-must-die-so...
> Because the sacred cow here is not just that mass migration must stop going forward. It's also that millions who are already in Europe must go.
He's suggesting we round up all the brown people and deport them... (He's smart enough to not put it in those words but I don't see what else it could mean.)
That is exactly what it means.
I wonder if that will change now he's gone from edgy opinions that rile up woke people (e.g. immigration is too high in the UK) to actually advocating ethnic cleansing (not the murdery kind but still...).
https://world.hey.com/dhh/three-sacred-cows-that-must-die-so...
I think that crosses a line for even normal politically centrist (by European standards at least).
His rhetoric has crossed into the murdery kind, actually:
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.
You don't get to make this contrast and pretend you didn't. The only way his rhetoric could be more clear is if he bought a gun and shot them himself.
It's always the same give these people enough prestige and power that they feel untouchable and their true nature comes to the surface. No more dogwhistling needed he thinks, I have powerful wealthy backers and their lawyers now.
Just like anything in tech recently, make a halo effect around whatever, over sell it, try to make a fanbase, and some connections here and there, and you got your meme product into a multi million product. It’s sad, there are dozens of better distributions out there and been in the game for years that deserve more exposure, but oh well.
isn't it a typical SV investor money hype train situation:
- project overpromise to a point of absurdity (e.g. Tesla (still has questionable full self driving), SpaceX (in recent times there had been absurd differences between claimed rocket load and what we then find out the rocket actually could load, like 100 Tons being only 15 Tons IRL level of differences), etc. etc.)
- project jumps on some hype train (e.g. AI)
- project has some eccentric owner which is good at selling it, even if it doesn't do what is sold
- owner also goes with the "move fast break things"
- owner acts widely (likely actually criminally) negligent in "safety" topics, shipping something is more important then the damage the negligence will causes, in some such such cases even if it's close to guaranteed that the negligence will kill people. Another way to phrase this point is they follow the "move at ANY cost so fast that competition can't keep up until you win by default" motto.
- owner has some "Vitamine B" connections to rich risk friendly investors (aka. the "friends help friends", "cartel-like", "kinda looks like corruption" structures we have been seen from time to time in the background of SV-related startup investments)
So I don't think you are missing anything about Omarchy, it's more like the whole investor culture around SV is severely broken, unhealthy and in their recklessness IMHO more damaging to society then its helpful. Not speaking about how this background structures twist the founding/startup marked in a way which may look to the outside to be "fair and open" but in fact isn't, if you don't "bow" to the right people and their ideology you aren't getting anywhere.
It's a shame because DHH seems to be going fully agentic (or at least that's his public stance), so no idea why he isn't rolling a proper distro. Looking at his repo it's just pure shell scripts (why?) and using prebuilt software. He could have rolled a custom renderer + pipeline + other software needed to make a distro work (ie a modern KDE).
Yes he could have, if agents were capable of it. Why didn’t he? Why didn’t you?
Oh, I believe agents are fully capable of it. Would you like to issue a challenge like that? I'd love to demonstrate their capabilities to you.
Go ahead and do it. Would love to see an improved Linux rewritten with agents. My personal belief is it would take a long time, lots of money and much human intervention/guidance but if you think they’re capable alone just do it this afternoon and see how it goes.
Come come, let's spec something real. You seem extremely doubtful, why don't you let me show you?
A techbros project that really cares close to nothing about FOSS ideals, apparently sided with far right politics.
rich guy has rich friends, cult of personality
It is going to be marketed to the AI bros. Possibly to Shopify customers as an "advanced AI distro" to create shops with. The openclaw guy just sponsored Omarchy.
It's a vibe coding distro, so of course there is no security to begin with.
DHH is also on the Slopify board, so AI is mandatory.
Just DHH being loud about it, getting his billionaire friends to join, and their usual tech-bro following astroturfing it (they somehow see it as a culture war thing to fight against the oppression from other distros and FLOSS projects that have code of conducts and don’t want to work with racists)
it get picked up by Hype because DHH
I think there is a pretty decent swath of people willing to rally behind someone who says they are trying to make a cool project specifically for people who want to be away from the "insufferable injection of identity politics". How large that swath is relative to the other is up for debate but it doesn't have to be particularly large. You'll get funding from people who are both interested in the actual product AND the posture, some from people who are just into the posture, and some who are just into the product. Ditto with interest from people to try it and or contribute time to it's development.
dhh is very strongly associated with identity politics, though? (as in, "western"/white identity)
This. The alt right in German speaking countries are calling themselves "Identitäre", which was inspired by French Les Identitaires. For all their criticism of what once was just a niche and fringe academic leftist movement, they are hypocritically are mirroring at least mirroring it if not more so. I believe they have actually helped progressive identity politics become mainstream as a reaction to their attacks on minorities, as a reaction to their hatred the mainstream has signaled their solidarity with minority identities, this is the main reason for Rainbow flags, to show solidarity against hatred.
The two linked issues are for the same bug report.
A friend has been urging me to install Omarchy for months. I’ve finally caved in after a horrible experience with highly-praised CachyOS.
All I can say is, I understand the hype. It works. The install is uncomplicated, no selecting from five legacy bootloaders, choosing versions or selecting a window manager. The tiled window manager works pretty much how I already use Mac. I like the terminal-focused system tools. Installing software is easy and lightning-fast.
Isn't Omarchy very, very similar to cachyos?
So, a Linux distribution.
Yo, why is my blog post title editorialised? It should've said "Merchants of Insecurity". Rude!
It was (my) main takeaway and I wanted it to be evident in the headline. I didn’t want to bury the lede; I’ll uneditorialize it because it seems it’s causing some fighting in the comments and I don’t really want to instigate anything, more just warn people using the distro. I don’t think it’ll reach the people who need to be warned if it’s not evident that there’s an issue from the start.
Appreciate it! Editorialised is fine but the post is mostly about the development practices leading to bugs & the lack of awareness of how dangerous that is, not about the current absolute number of security holes if that makes sense.
Agreed! It’s a good post.
Probably so people can understand what the post is about and can skip the rage-bait?
How is my title a rage bait?
The current submission title is terrible, "Omarchy development practices lead to predictable security issues" would be much closer.
So be it!
Great title btw
Aww, thank you!
No offense but your title is not informative at all.
It wasn't supposed to be, I found it amusing. Also, the current title is not what I wanted people to take away from the post.
This tumblr level of discourse is precisely what the Linux community needs to leave behind.
Isn't the rise of AI basically turning software engineering into tumblr? Thats what I see; soon we'll have a forum that's just filled with roblox-but-for-adults.
Seems to be the “dream” the AI leaders want to sell at least
A bunch of terminally online people have decided to make stalking DHH into a personality/lifestyle. This blog is incorrectly titled, because it doesn't talk about security holes at all.
edit: I don't care what people decide to do with their linux distro that I'm probably never going to use. I suggest you try Debian.
What would you characterise the two linked security reports as, if not holes?
The two links are the same same bug. Hardly "full of security holes"
I would characterize them as "links." As opposed to a discussion of security holes.
I think I would argue that linking to the security problem(s) and then writing about their style and how they probably came to be counts as discussion, but to each their own.
I didn't know security holes had a "style." I suppose their style is "literal Nazi" judging by this thread.
The blog mentions AI and untrusted input sanitisation. Hope your day gets better.
The HN submission link is incorrectly titled.
The blog is titled "Merchants of Insecurity". The word "hole" does not exist anywhere on the page, the HTML, or the HTTP headers.
Yesterday's submission used the correct title: https://news.ycombinator.com/item?id=49433378
> doesn't talk about security holes at all
Literally the first sentence in the post has links to two security holes lol
That's not talking about security holes, that's linking to talk about security holes lol
> decided to make stalking DHH into a personality/lifestyle
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.
An intellectually honest guy like you is probably so furious that DHH makes a personality out of stalking entire peoples. Pathetic++, right? :^:
> A bunch of terminally online people have decided to make stalking DHH into a personality/lifestyle
aka A person should be able to espouse xenophobic and bigoted remarks without worrying about being criticized for it.
"But won't someone think of the tech bro who incessantly talks out of his ass and punches down!!!!!"
Apparently the Omarchy plugin ecosystem is also a free for all like the Arch AUR, except the audience includes people who are new to Linux and less likely to understand the risks.
A lot of plugin systems are like that. (See the hyprland, noctalia, or vim/neovim's plugin systems).
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
Obviously every single loaded take on this distro has already been taken, on this thread alone. So there is little anybody can add to it... all I would say is that no publicity is bad publicity and if that's the intention, then well done.
I am happy that the Linux ecosystem is getting attention, traction and funding. People that dont like and want to choose to go die on another hill, so be it, their prerogative.
I have been seeing so many podcasts and YouTube videos about Omarchy in the past week or so. Must be a massive marketing push or just hype.
That feels very astroturfed, it’s just too much too fast
DHH has a large following, so do many people in this network. His blog posts are often discussed here, it's not really surprising that it gets attention and you don't need secret astroturfing or sneaky marketing if people just share / interact with it themselves organically.
Literally funded by Michael Dell and Jack Dorsey. And DHH is just coasting on his ruby on rails clout.
Just hype, it's Kagi all over again. People said the same thing there, we're just too cynical, not used to people getting excited about really cool stuff anymore.
They just announced the new "Omacom foundation" last Friday, with $8 million of funding from prominent tech people. That's why it's getting current flurry of attention
It's been showing up all over YT for a while if you do any searches for Linux.
I took a look at it when I kept seeing it, realised what it is and who it's by and carried on moving, putting aside DHH as a person, it doesn't really do anything I want or in a way I'd care about but then I'm also not the target demographic/user, after 30 years of using Linux, I don't need it.
There is this meme of a bell curve where the left side is some newbie trying to do something obvious, the right side is a "pro" trying to do the same obvious thing, and the middle is a someone trying to do cool/new/trendy stuff.
The left side us Ubuntu/Fedora. The right side is Arch. The middle is all these tech-fluencer-wanna-bes custom-made-ai-enhanced distros.
Your left side of the curve is missing people like me who use Fedora.
Been using Linux since 1997, it's been my primary OS since ~2003 (except for gaming and Microsoft seem determine to end their streak on that one) and I use Fedora because I really don't care that much, it's a reliable tool, it has recent packages and I like that it's semi-rolling in that it's a straight forward update every 6ish months.
I had my "I must customise and control every single part of my Linux install" phase early (Slackware and Gentoo et al) and then I realised I didn't actually care all that much, give me sane defaults with the ability to tweak if I want to and stability, I'm at the point where "If I have to think much about my OS it's failed in doing what I want" holds.
The right side is Nix
Pretty embarrassing, but its nice to see them actually putting effort into security. https://omarchy.org/security/
Too few upstarts realize that proper security is core to a good experience.
If they're going agentic and using the stack that they're using (qt/shell scripts?) they'll never patch it in full, if ever. The thing is almost certainly full of injection/forgery attacks, on top of being bloated to oblivion.
"In full" is a tall order that no other OS or distro claims.
No reason Qt or quickshell is any different from any other software.
Bash is... harder, not impossible. I wouldn't rely on it.
Isn't most of the security holes still there if used arch and installed the packages yourself. A lot of people complained ssh had security issues in omarchy because it used the default settings. That would still be the same on arch?
heh... i still remember the very first time when it came out with it's opinionated branding and all that, looked good and went ahead to try it out but was so annoyed with all the bloats and promoting their software's in it which made me their intentions already clear. I got to know that recently they've added option to remove all the bloats but IDC anymore. not gonna try that ever. Not to mention it was just dotfiles painted on top of arch iso and documentation itself included archinstall guides - if that's a distro then my system with dotfiles are a distro in itself lol... though it looks like they've changed things up now, it looks like it has a iso's and all the stuffs to be called a distro now.
this is not what they say https://github.com/basecamp/omarchy/blob/quattro/manual/48-s...
Not following Omarchy, not even sure what it is trying to be compared to existing distros (other than an incredibly hyped up product). Not hating on DHH. But hasn't he become famous for developing a web framework (20 years ago), rather than for his technical prowess as a systems-level engineer? Seeing these kinds of bugs is not exactly unexpected.
It has nothing special compared to Arch. In fact, I would argue its just dotfiles for Arch.
I suspect his pitch here is that he knows UX and is technical enough to make it happens, rather than that this is a serious server OS.
Hey and Basecamp suck. Basic features like search barely work, the iOS and Android apps are embarrassingly bad, and the UI looks like it was designed for Netscape Navigator 4. With Rails, dhh spent years trying to work around JavaScript , leaving the framework increasingly difficult to recommend in 2026. Why on earth would you trust him with your OS ? Even if you share his politics, you deserve better software.
“Full of security holes" - and two examples in the article have been swiftly addressed, ignoring that there is a whole dedicated security team https://omarchy.org/teams/
What kind of blogging is this?
> What kind of blogging is this?
Happy to explain: it's personal blogging, for writing down what's on my mind.
The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.
Also, the "full of security holes" is not my framing, someone else choose this submission title.
The problem with those two picked examples is that their nature displays a lack of basic care and due diligence.
Of course, this is a culture war, but the point the blog post is making is that the Omarchy side is not exactly at the forefront of merit.
The same kind as a similar recent post [1] where a person pointed out a bunch of problems with Omarchy's shell scripts as examples of it being terrible.
Open a pull request.
That's how this is supposed to work. Wisdom of the crowd and what not.
1. https://xn--gckvb8fzb.com/a-word-on-omarchy/
Why would I do that? It's a crazy non-sequitur.
My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.
In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.
Because you could make the world a better place instead of just complaining about it? I don't understand the "all I wanna do is complain" process at all.
Fix it. If you see a problem in the world, fix it.
If they reject the fix, that's when you complain.
I do t just complain. I making the world a better place in ways which I believe are worth it.
Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.
Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.
You're not suggesting that you can't criticize something unless you're willing to fix it yourself, are you?
Surely those won't ever get fixed...
effects of vibe coding + the zealotry like passion of DHH & this is the result.
I don't know, Omarchy's team really don't care if you're complaining.
Wouldn't the security team and the agents just go and fix the security holes?
They have a dedicated security team now that is being paid for this:
https://omarchy.org/security/
But having a dedicated security team is marketing?
I'm sure with the $10M cash chest the security will just improve over time and this blog post will be irrelevant.
I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
There's a difference between a few small bugs because software is new and a half dozen eval(untrusted_input) in version 4.0.
Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.
> Wouldn't the security team and the agents just go and fix the security holes?
Of course they’re going to react to what is reported and fix it. That’s a given.
The concern is the development process that is leading to these types of holes getting shipped. Mainstream Linux distributions have software practices and release cycles designed to be cautious. This project is taking more of a move fast and break things methodology where shipping the vibe coded feature as fast as possible is the priority.
Having a crack team of people responding to reports and fixing things (or prompting their agents to fix things) only solves the issues after they’ve been shipped, discovered, and kindly reported back upstream.
> I don't know, Omarchy's team really don't care if you're complaining.
Controversy is their primary marketing tactic. They prefer that people complain because being divisive and controversial is how DHH has always marketed his products.
Yea, I don’t get the shade. As many have said, it’s just Arch + a very polished UX preconfigured so you can jump right in without a lot of setup overhead.
Why it’s security would be on a different level than any other Linux distro isn’t clear.
It’s a bit more than Arch. There are a bunch of programs written in shell and QML/JavaScript. I guess at least they are using memory-safe languages, but shell scripts make it easier to write the type of shell-injection bug mentioned in the article. Personally if I started a new project in 2026, I would not choose bash and vanilla JavaScript as the languages to write it in.
The repo for reference:
https://github.com/basecamp/omarchy
Because the "polish" is done in an insecure way?
No, I don't like the style,but author is right here, you cannot secure insecure design. It needs to be reworked from scratch.
If they are interested in complaints. Probably they do not, so people write blogs on their own. This kind of also happened in the rails world; some people got upset at DHH and then started writing complaints; and many of these complaints are by themselves also total garbage (some are more objective criticism, these tend to be better). It's kind of agenda-based everywhere.
> I don't expect the security to be perfect out of the gate at when Omarchy 4.0 just launched with real backing?
Well, we can note the time and look again in half a year or so. Personally I am in general happy with security in the linux ecosystem. I am more worried about e. g. systemd adding age sniffing as component. In another entry at hackernews, yesterday I think, we learned that Microsoft automatically tags all images with invisible watermarks. One just can not trust companies - they always feel a need to abuse data from the users and tags everyone. Next step will be mandatory chips into the brain.
It is probably true that it has a big attack surface. But omarchy is no doubt a huge driving force. A few days ago I listened to a podcast dhh talking about the latest major release and its huge donation. I believe it’s now 10m usd or something. I am hopeful that dhh is serious enough to address the security issues plus a lot of ux improvement on linux.
In the episode he emphasized 17 layers of security layers where I remember the number solely because I found hard to believe to be honest.
You can find the podcast episode in this one https://thestanduppod.com/
The "distribution" made by... DHH. No, I can't, thanks.
For people who don't know, just read "As I Remember London" by this person.
Sure, arguments can be made in favor of being "above all these things," but profound moral disgust can also be a legitimate argument.
"full of security holes" but the author could only name one (the two links in the opening paragraph are the same issue).
Some people just hate DHH and can't separate the art from the artist
They point to two separate issues, what are you about?
They're both the same root cause. Command injection in notifications
Look - I'm am the opposite of DHH fan -- that said -- they could fix all these bugs/security issues that same way they created them. It makes sense to some extent to create a product that emphasized what is different about it from a feature/UX perspective so people can consider if it would even be useful to them at all. If they can prove that they have created something useful - then they can fix all these issues. Fixing these issues is not hard. Creating a useful product that people want -- this is the hard part.
>DHH loves to say he's making the year of Linux on desktop happen.
I'd stay away just for this reason alone. Anybody that says this is either joking or has no clue how the real world works.
> Anybody that says this is either joking or has no clue how the real world works.
So the "real world" is that Linux failed on the desktop and it is not worth trying, meaning that raising $10M to do this a joke?
Would you say the same thing if another distro raised that amount of money? Or is it because DHH is the one doing it.
This sort of thinking is why Linux on the Desktop worked for Windows, instead of it becoming mainstream with its own distro.
The "real world" is long term results. Yes, this is a joke amount of money for building an OS if the goal is conquering desktops and holding the territory. It is obvious to everyone the "Year of the Linux Desktop" attitude with only $10M in funding isn't going to end the way they want.
larp discovered to be a larp more news at 11.
At this point, it looks like some here in the Linux community have a new found hobby of actually liking to get angry at things instead of building now that AI took away their identity.
This is just a person having fun building their own distro. If you don't like it why are you giving them so attention even though you will never use it?
Ok I think I see the issue
It's lines, lines and more lines of bash script
sigh
big sigh
Using bash for all this stuff is like trying to wash your car with sandpaper instead of soap and water. Yes it can work if you're really careful with it, but in practice no
Yep. Considering LLMs spit out Rust/C++ faster & better than Bash no idea why they went this route.
Which distro is not full of bash scripts?
It's also funny that all the systemd critics call that bash scripts is all you need
Not in the amount I see there
And yes while I got more favourable to Systemd I cannot say bash is all you need, no
Just read DHH's blog and then you may quickly realise that other distributions may be a better choice. There is a difference between "opinionated" and ... whatever the content criteria is for DHH nowadays to write stuff on his blog.
Younger DHH was more impressive than the TechBro aged later variant, in my personal opinion.
Arch is in general a good base though - I mostly use Manjaro as base, then customize it via a ton of scripts and compile about 99% from source anyway, using an extended set of ruby scripts (a bit similar to homebrew, but one big difference is that I wanted versioned AppDirs like in GoboLinux; my scripts originated from GoboLinux's philosophy since I did not want to use shell scripts but retain versioned AppDirs. Manjaro is in some ways a bit similar to oldschool slackware, which unfortunately kind of died - it is not really fully dead, but look at the homepage and then tell me how many years past the last .iso release still counts as alive. So to me it is dead, despite the changelogs still being updated or others, such as alienbob, pushing out new releases.)
What is the point of a new desktop Linux distro if you're gonna give it another dogsh* name no one can pronounce?
Is it not supposed to be om-archy? (This is the first time I even hear about the project.)
apparently, the r is silent. "oh-mah-chee" https://x.com/dhh/status/2016912045124305303
DHH pronounces it oo-mah-chi.
lol of course he does
I think it's oh-my-arch, remove h and move y to the end.
this is why i use arch btw
I will be giving all of my future projects names like f4xa74 just for you
Is it pronounced as Omar Chy?
Omar Chai?
Omar might as well have some Chai
When I was a kid my mom had a daycare and had access to a program where she could buy older and used desktops at a discount.
I loved installing different operating systems on them and try to customize it. Better window management, better animations, nicer colours etc.
Of course, the results were always marginally better or worse than the stock version of that distribution.
Seems as this is the case for Omarchy here as well.