Omarchy has changed its Kitty configuration after a security issue was identified with allow_remote_control yes.
That setting allows Kitty’s remote-control protocol to accept commands from terminal output, meaning untrusted output could potentially execute commands as the current user. Kitty itself defaults this setting to no; the exposure came from Omarchy explicitly enabling it so other parts of the desktop could query the active terminal’s working directory.
The change disables remote control by default and migrates existing explicit yes settings to no. Users affected by the migration need to fully close and reopen Kitty, as existing processes remain exposed until they exit.
There is a small trade-off: Omarchy can no longer reliably determine the active Kitty tab/pane’s working directory via its socket, so new terminal or Files launches may occasionally fall back to the home directory.
The associated migration tests reportedly pass, although no live Kitty test was run in the test environment
"Alright ai, now make me a cool linux distro. Don’t add too much of that facism we talked about. Oh and to get funding from the NSA we need to slip in. Misconfiguration. Make it look accidental. "
I would be so happy if people stopped giving this #fashtech attention and just banned any mention of it on the fediverse. Any press is good press. I’ll be adding a filter to spare myself the blight.
Wait… An AI slop ‘distro’ has a significant, built in RCE vulnerability? No way.
Does anyone use this vibecoded slop OS from fascist fans unironically?
Unfortunately yes. Somehow the buzz around it has resulted in a decent number of e.g. YouTube channels with dev content talking about how great they think it is, which is bad for the discourse IMO
It’s definitely being pushed by influencers, but there’s no way it’s getting any real adoption. People already familiar with Linux aren’t installing this for real use em masse, and people not familiar aren’t going this route with their first distro. I think the hype is all fabricated and pushed to the forefront of the algorithm.
Yet they received millions in funding
🤣🤣🤣 First XLibre, now this. Right-wingers have no right to use the term LIBRE.
Why do you need some terminal remote control for determining the working directory of a terminal exactly? Can’t you just go down the process tree until you find the shell and do
realpath /proc/<pid>/cwdon it? Am I missing something?