Merchants of Insecurity

Do not utilize Omarchy unless prioritizing machine security is not a concern. This version of Omarchy 4.0 is riddled with vulnerabilities, ranging from video title injection to the execution of arbitrary bash scripts on user's machines. These security flaws are particularly troubling considering the team's apparent commitment to safeguarding systems.

It appears they are merely putting on a facade of security, but their actual practices paint a different picture. The ease with which they propagate decades-old security issues and introduce new ones suggests a lack of genuine dedication to maintaining a secure system. This assessment is further supported by DHH's marketing efforts, which frequently highlight the polished user experience and security team's recent accomplishments, while downplaying the project's inherent security risks.

Such a strategy can be seen as deceptive, as these marketing tactics paint a picture of robust security that doesn't align with the actual state of the software. While the security team's efforts might look impressive on paper, they are built upon a foundation of Swiss-cheese-like vulnerabilities. It seems DHH's approach of "fucking doing it" may be more about rapid iteration of personal dotfiles than about ensuring the basic security of the system.

It's disheartening to see how the project fails to address these serious security concerns effectively, and how the team seems uninterested in accurately communicating the level of risk to its users. The lack of transparency and the deceitful marketing of Omarchy could potentially harm users, making it a project best avoided.