If you're a user of the "opinionated" (LOL) Omarchy distro, you might be a simple few clicks from code execution from your browser

[wdormann@infosec.exchange]

@buo
It boggles the mind.

[wdormann@infosec.exchange]

Stop USB device names from being executed as Hyprland Lua

This isn't a serious distro.

[sempf@infosec.exchange]

@wdormann Wait, USB drive names EXECUTED? What chocolate crunch fuckery did they do to make that possible?

[viraptor@cyberplace.social]

@wdormann
Oh joy, it's fixed by filtering the input and hoping really hard that nobody writes a new simple entry point. Why needs proper escaping...

[wdormann@infosec.exchange]

@Sempf
Hatred makes it possible.

[alesandroortiz@infosec.exchange]

@wdormann And works as a quick USB device plug-and-remove attack from the lock screen. Plus allows persistence. Incredible.

PoC video by reporter: https://youtu.be/pgNvD9DaZxY

[christopherkunz@chaos.social]

@wdormann Kinda lost me at "Opinionated Linux by DHH".

[zardoz@ioc.exchange]

@wdormann using 3 agents to solve it is the cherry on top lmao

[wdormann@infosec.exchange]

@zardoz
"solve"

[caspicat@infosec.exchange]

@wdormann @buo TIL Omakub stopped being a thing

[wdormann@infosec.exchange]

Or if you want an LPE shell script, have at it.

Note that I've twice called Omarchy a "distro", which is perhaps unfair. It's apparently just Arch that's preconfigured for those who do enjoy editing config files with Neovim, but avoids security and wokeness.

[nemokamui@infosec.exchange]

@wdormann isn’t it cool how @framework lost their good will by sponsoring that slop?

[clouderst@abc.clouderst.xyz]

@buo @wdormann it unfortunately get a lot of free press as the "best linux distro rn" from networkchuck, switch and click, and random channels.

tho i've never actually seen someone keep using it after milking it for content. and nobody bothers to point out DHH's antics and the fact that the "distro" (as they call it, it's a rice) is more and more vibe coded

[wdormann@infosec.exchange]

@clouderst @buo

Well if networkchuck says it's the best, that must be the proof.

[wdormann@infosec.exchange]

@clouderst @buo

Lordy. TIL "NetworkChuck" is a YouTube talking head that claims to know computers, yet calls calls a laptop "an old gaming desktop"

I don't think I have the mental fortitude to make it more than the 2 minutes in that it took to get this.

[clouderst@abc.clouderst.xyz]

@wdormann @buo yes, the downfall must be studied, the only good videos nowadays on his channel are the old how IP and internet works playlists

[clouderst@abc.clouderst.xyz]

@wdormann @buo it's become mostly ai slop channel with bad tutorial about how to set up private ai and run the most powerful model or openhermes or type shit