thehappyfellow

I'll take that.

They are amazingly good at creating hype (non-derogatory) and getting users.

Their docs say "Omarchy takes security very seriously" - I think that's straight up incorrect.

Saying "go and use it, wanting: its prototype quality and likely to have many security bugs" would be fair game.

That's not what they're doing.

I dont just complain. I making the world a better place in ways which I believe are worth it.

Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.

Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.

Appreciate it! Editorialised is fine but the post is mostly about the development practices leading to bugs & the lack of awareness of how dangerous that is, not about the current absolute number of security holes if that makes sense.

Why would I do that? It's a crazy non-sequitur.

My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.

In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.

Aww, thank you!

How is my title a rage bait?

The current submission title is terrible, "Omarchy development practices lead to predictable security issues" would be much closer.

It wasn't supposed to be, I found it amusing. Also, the current title is not what I wanted people to take away from the post.

> What kind of blogging is this?

Happy to explain: it's personal blogging, for writing down what's on my mind.

The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.

Also, the "full of security holes" is not my framing, someone else choose this submission title.

Yo, why is my blog post title editorialised? It should've said "Merchants of Insecurity". Rude!

They point to two separate issues, what are you about?

There's a difference between a few small bugs because software is new and a half dozen eval(untrusted_input) in version 4.0.

Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.

That's what I had in mind! The whole post is a claim that evaluating knowledge work got more expensive because cheaper measures stopped correlating well with quality.

If someone was already evaluating the work output using a metric closer to the underlying quality then it might not have been a big shift for them (other than having much more work to evaluate).