At today's meeting, Omarchy & Open Source funding was discussed. Security was one aspect of that.

And, on cue, Brodie Robertson has a video out about:

This Security Bug Is Too Funny To Ignore

It has to do with Kitty terminal (now the default terminal in Omarchy) with kind of crazy default settings. Like "allow_remote=yes".

Some links:

As a POC, unzip the attached pwn.zip file, and run cat pwn.txt in a kitty instance with remote control enabled. It will run the command touch /tmp/pwned. This could easily have been called README instead and the command could have been rm -rf /. The kitty got pwned by a cat! This breaks a lot of deep implicit assumptions, such as "catting a file should be like, the safest thing to do, ever".

https://github.com/kovidgoyal/kitty/issues/2084