This is not about DHH, who I do not like. This is about his idiotic security decisions and how they could end up reflecting badly on Framework even in non-political contexts.
Most of this will be a bullet point version of https://xn–gckvb8fzb.com/a-word-on-omarchy, specifically the part on security. You should read the whole thing, it’s a good article, if a tad elitist.
- Up until Omarchy 3.1.0, despite claims otherwise from 2.1.1, the firewall, despite being configured, was not actually turned on. This does not inspire confidence that other security systems are working.
- Said firewall also allows SSH through by default, which is not a bad thing on its own if you are a developer, but OpenSSH is kept at its insecure defaults on installation. This opens up an everyday user’s computers to brute force attacks that would not be possible by default on Windows and MacOS. It really should be off by default, so that users who need it will go on the Arch Wiki and see all the warnings.
- Hansson says he takes security seriously, but does not make use of security mechanisms built into the kernel such as Linux Security Models, does not use the linux-hardened kernel by default, or patch stuff to use musl and hardened_malloc, among other things. Instead, he has weakened it by increasing the number of password retries and decreasing faillock timeouts.
- Some of his scripts commit the cardinal security sin of piping curl into sh. This essentially executes code from the internet without review. Hope that domain DHH is getting scripts from isn’t hijacked by a paranoid NSA!
- Omarchy uses ad-hoc bash scripts instead of proper packages. This makes security issues hard to find. It also proves that DHH knows less about Arch packaging than me, someone who lives with their parents and just had to go back to load the dishes twice. Arch packaging is really that simple if you know shell scripting.
All of these tell an informed buyer of Framework one thing, no matter their political orientation: that Framework knows nothing of actual security and does not vet the distros it recommends. I hope Nikev learns from this why most programmers pragmatically don’t like racists: the code they write is all form and no function and they have no idea of the deeper parts of a system.
If you want an Arch distro that’s easy to install and use by the layperson to replace Omarchy, might I recommend EndeavourOS? It’s basically Arch with a GUI installer, and I trust them far more than DHH, who has proven he has not even heard of PKGBUILD, the fundamental packaging format of Arch Linux. Hell, even Manjaro would be better than Omarchy, as the distro maintainers, inept as they are, at least try to be friendly to GUI users, even if it ends up falling kind of flat.
If you really need something to show investors what open source can do, might I recommend installing CachyOS with Niri? It can be configured to look almost as good as Hyperland, it’s far better at handling the modern app ecosystem, and it makes its benefits known after you open two applications by default. I can personally promise you that it would be very compelling to anyone who has had to wrestle with iPadOS’s window management, and that Niri would be an excellent WM to sponsor.
That being said, if you are done reading this and want to say something, please try to keep the conversation on DHH to laughing at his mistakes, as I would argue the nature of those mistakes reveal far more about DHH than his posts. That being said, lambasting me or the author I paraphrased from for being a moron is not off-limits.
