I was expecting a more sophisticated attack and then I scrolled down…

> Omarchy configured its default user as a member of the Linux docker group.

What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation.

https://docs.docker.com/engine/install/linux-postinstall/

Why would you want to make this the default for your users, without even telling them? Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro??? Makes you wonder how much other crap is there.

▲

dragonwriter 4 hours ago | parent | next [-]

> Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro???

Isn't that the entire selling point of Omarchy?

▲

k_roy 4 hours ago | parent | prev | next [-]

Default configuration or not, I also imagine the first thing people using docker do is to add themselves to the docker group via sudo.

If you are security-conscious, you shouldn’t be using docker anyway.

▲

pibaker 4 hours ago | parent | next [-]

If you are adding yourself to the docker group, you have presumably read the documentation and its warnings. Does an Omarchy user know the distro has made the decision on their behave?

TFA spells out why this is wrong better than I could.

> There is another important aspect of this configuration. It was opt-out, not opt-in. A user did not have to actually use Docker. The security tradeoff was made for them, applied to the default account, and the tradeoff was not explained to the user.

> Security-sensitive defaults matter precisely because many users reasonably assume that the operating system defaults to secure and will inform or prompt them to opt-in to less secure settings.

	▲	k_roy 4 hours ago \| parent [-]
		I am not disagreeing at all. Nor am I trying to claim this behavior is safe. I’m just pointing out the level-set that I’m sure the first time someone installs docker and tries to use it, chances are they are just going to install themselves in the docker group without considering the impact and continue on their day.

▲

inigyou 4 hours ago | parent | prev [-]

I have passwordless sudo anyway. XKCD knows why the password is pointless.

▲

inigyou 3 hours ago | parent | prev | next [-]

I didn't know that was unsafe.

Well, it's not unsafe because anyone who can exploit it has already fully compromised my PC. It rather involved being on the other side of this airtight hatchway. But I didn't know that putting an actually locked down account in the docker group was unsafe.

▲

esskay 4 hours ago | parent | prev | next [-]

> Why would you want to make this the default for your users

Because DHH doesn't have a clue what he's doing and is farming his brain out to Claude. Again.

▲

qweqwe14 4 hours ago | parent | prev [-]

Because it's convenient, and the security of this doesn't matter for desktop usage.

	▲	4 hours ago \| parent \| next [-]
		[deleted]
	▲	iririririr 4 hours ago \| parent \| prev [-]
		lol. people will vote you and not realize the irony. just look at all the comments "this is a fair and common mistake" that are not being ironic.