Piotr Skubis

I over-engineer stuff at home so I won't do it at work

[Piotr Skubis @psqbs]

@progXprog zasadniczo jest tani i szybki, w czsach "claude/codex robią za mnie wszystko, włącznie z myśleniem" to jak widać wystarczy

[Piotr Skubis @psqbs]

@ThePrimeagen They are also heavily pushing fast mode which is no longer that fast and just burns way more tokens, same for non challenging tasks given to composer 2.5.

[Piotr Skubis @psqbs]

“Comment below and I’ll send you the links”

is easily the most retarded trend in recent social media history

[Piotr Skubis @psqbs]

@theo By coding agents he means those ran within Claude and codex desktop apps. Apparently that’s the way he uses it.

[Piotr Skubis @psqbs]

@GohilHardy when AI is down can maintain none of it...

[Piotr Skubis @psqbs]

“I didn’t fasten my seatbelt and I’m still alive, so I guess we don’t need seatbelts.”

Same level of argument.

I genuinely wonder why every time some retarded billionaire ships something obviously broken, there’s always an army of idiots rushing in to explain that actually nothing serious happened and he’s still God’s gift to humanity.

A notification could run bash.

If that’s not enough for you to understand how dogshit this release was, I’m not qualified to help you.

[Piotr Skubis @psqbs]

The fact that it wasn't deliberate is exactly my point, not an argument against it.

I'm not saying they knowingly shipped vulnerabilities.

I'm saying: DHH claims that with frontier agents, money and enough people, they can fix basically every problem blocking Linux desktop adoption.

Well, they have the agents. They have the money. They have the people.

And they still shipped a major release with serious security issues they didn't catch.

That's the gap I'm criticizing. Not that software should have zero bugs.

Other companies have money and AI agents too. They still make mistakes. The difference is they usually don't go around acting this confident that they can “fix everything.”

[Piotr Skubis @psqbs]

@ardent__dev GDPR

[Piotr Skubis @psqbs]

You're arguing with a point I never made.
I never said Omarchy should have zero bugs or that Microsoft doesn't use AI.
My point is: if your pitch is essentially “frontier agents + money can fix everything,” then a release shipping with multiple RCEs deserves scrutiny.
AI isn't the issue. The gap between the confidence of the claims and the quality of the execution is.

[Piotr Skubis @psqbs]

/ponytail /i-have-adhd skills
/compact often
avoid long conversations
smart model as orchestrator, cheaper ones as subagents, orchestrator provides subagent all needed context single shot to complete task to avoid research by subagent
slow mode everything, paralell agents with small context in slow mode working better then one agent working fast in large context window

[Piotr Skubis @psqbs]

@ntbrown01 @bestaiever

They do have bugs (including RCEs), but they’re usually found later by security researchers and are rarely this obvious.
Also, Microsoft and Apple don’t go around social media bragging that their systems are built by the “best AI agents.”
There wouldn’t be any of this drama if it weren’t for the pseudo-hype pushed by DHH, combined with shitting on the existing Linux community by calling them clowns and so on.
Pride goes before a fall — and the more inflated the balloon, the louder it bursts.

[Piotr Skubis @psqbs]

@dhh Then why all of those resources produced 4.0 release with bunch of RCE vulnerabilities?

I had extremely big expectations, because I ran Omarchy 2.0 some time ago… but this.

It needs to do better.

Also conflicting criticism of bugs and issues with hate won’t take us anywhere.

[Piotr Skubis @psqbs]

@vulo133 @dhh you're right, can't edit now

[Piotr Skubis @psqbs]

In his 4.0 big release he managed to ship:

• USB device names executed as Hyprland Lua (code execution, even from lock screen)
• Video title injection in Download Video (notification click → RCE)
• FIDO2 authfile staged at predictable /tmp path (race + ownership issue)
• Notification click actions run unsafely (bash)
• User added to docker group by default (privilege escalation)
• Installed themes able to run code
• Untrusted PATH in privileged DNS helper (root via writable checkout)
• plugin-add vulnerable to git transport-helper URLs

They should be fixed now or vibeFixed, which worries me even more.
DHH shipped objectively insecure distribution to thousands of machines, driven by purely by hype.

[Piotr Skubis @psqbs]

@brainscott @typecraft_dev @NetworkChuck And bugs to their machines.

[Piotr Skubis @psqbs]

@lucasMnts @mr_the_dooom But there are clowns and tigers in the circus, I’d assume he thinks of himself as the latter.

[Piotr Skubis @psqbs]

@OmarchyLinux users, can we all agree on this common ground?

✅ Bringing more people into Linux → GOOD

❌ Shipping security holes to thousands of machines owned by unaware users → BAD

No excuses.
No “but adoption tho”.
Security first, or don’t ship.

[Piotr Skubis @psqbs]

@typecraft_dev @OmarchyLinux Can we all agree on this common ground?

✅ Bringing more people into Linux → GOOD

❌ Shipping security holes to thousands of machines owned by unaware users → BAD

No excuses.
No “but adoption tho”.
Security first, or don’t ship.

[Piotr Skubis @psqbs]

@thdxr We should move from:
"A little copying is better than a little dependency."
To:
"Even a lot of copying is better than a little dependency."

[Piotr Skubis @psqbs]

@NetworkChuck @dhh You know what’s even more contagious than his passion?

Infected machines joining some Chinese botnet because someone thought it was a great idea to allow shell script execution through notifications.