Episode notes
Omarchy, David Heinemeier Hansson's ready-made Arch desktop, put the default user in the docker group, which Docker itself treats as root, while the docs said you could run Docker as a normal user and not as root. Version 4.0.1 takes the user out and hides the old default behind a warning. Alex and Jordan look at kernel.org spending fourteen of ninety cores rendering commit pages for scrapers who could clone the history for free; Qubes security bulletin 118, where copying a file from the admin desktop lets a bad VM sneak a command into a shell; and Google Maps showing Lake America to US users after a government names change, while Canada still sees Lake Ontario. The side of tech news nobody talks about.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-08-31
In this episode
The brochure is not the config — Omarchy's default install put everyday users in the docker group, which is the same as root. The documentation said not as root. 4.0.1 moves that into a warning menu. Existing sessions keep the group until logout.
Fourteen cores for the robots — kernel.org spends about a fifth of its CPU drawing commit pages for scrapers. The same history is a free download. A third of the bots now solve the puzzle that used to stop them. Next they will turn features off for anyone without an account.
A filename with a command in it — Qubes bulletin 118. Copy a file from the admin desktop into a compromised box and that box can answer with a filename that a shell will run. Only that one direction. The patch is written and still in testing.
The label moved — A US executive order renamed Lake Ontario to Lake America in the official place-names list. Google Maps in the United States followed. Canada still sees Lake Ontario. Apple and MapQuest had not followed as of Sunday.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
Jordan. Top of Hacker News. There is a ready-made Linux desktop called Omarchy, from David Heinemeier Hansson, the Basecamp founder. Its default install put your everyday login into a group that hands you the whole computer.
0:13
Jordan
The whole computer meaning what?
0:16
Alex
On Linux one account owns everything. It is called root. On that default install, any program already open in your session could become it. No password. No prompt. The browser you left open counts.
0:28
Jordan
And the setup notes said what, exactly?
0:32
Alex
That the group was there so you could run Docker as the normal user, and not as root.
0:37
Jordan
That is the wrong sentence to have written down.
0:41
Alex
Two more tabs and a quick one.
0:44
Jordan
kernel.org, where Linux itself gets published. The maintainer counted fourteen of their ninety processor cores doing nothing but drawing web pages for AI scrapers. The same history is a free download, one command away.
0:58
Alex
Qubes. The operating system built so everything you do sits in its own sealed box. Their own bulletin says a bad box can run a command on the admin desktop, through an error pop-up.
1:10
Jordan
And the quick one. Google Maps in the United States now says Lake America. Open the same map in Canada and it still says Lake Ontario.
1:18
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
1:27
Alex
That's us. I'm Alex.
1:30
Jordan
And I'm Jordan.
1:31
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
1:37
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:42
Jordan
If this is useful, subscribe. We do this every morning.
1:46
Alex
Story one. Omarchy is an install-and-go Arch Linux desktop. You run it once and you get a whole machine, already set up. Until Friday, that setup put your login in the docker group.
1:59
Jordan
Say the group part like I have never touched it.
2:03
Alex
Docker runs programs in sealed boxes. The piece that starts those boxes runs as root, the account that owns the machine. Anybody in the docker group can ask that piece to do anything.
2:14
Jordan
And I am in the group, so...
2:17
Alex
So is everything running as you. Your editor. Your package installer. The browser sitting on tab forty. Same user, same power.
2:26
Jordan
So it is not a browser hole. It is not a Docker hole either.
2:30
Alex
It is not a hole anywhere. It is a default in the distribution. Docker's own documentation has said for years that this group is the same as root. One request opens a box with your entire hard drive inside it, and now you are reading the password file.
2:46
Jordan
Who found it?
2:48
Alex
A researcher writing as trap0xcc. Reported it privately. Version 4.0.1 takes the user back out.
2:56
Jordan
And before Friday the documentation said...
2:59
Alex
It is right there on the page. Run Docker as the normal user, and not as root.
3:06
Jordan
Which is the exact opposite of what that group does.
3:10
Alex
That is the part I keep chewing on. I am deep in this logging migration at work and I would not close a ticket because the vendor brochure said not as root. The brochure is not the config file.
3:22
Jordan
Look at their own list of what inherits it. Browser. Editor. Package installs. The AI coding helper.
3:30
Alex
All of it, running as you.
3:33
Jordan
So the thing you told to go fix your tests, alone, at two in the morning, already owned the machine. Nobody had to break in. It had the keys.
3:43
Alex
The pushback in the thread is fair, and I want to say it out loud. Half of Hacker News says everyone adds themselves to the docker group.
3:51
Jordan
They do.
3:53
Alex
They typed it, though. They chose it, on their own machine. Omarchy chose it for everybody who wanted a nice desktop.
4:00
Jordan
And the fix did not remove the option.
4:04
Alex
It moved it. Setup, then Security, then Sudoless Docker, behind a warning. Which is the honest place for it.
4:11
Jordan
Honest place, and every session still running keeps the group until people log out.
4:18
Alex
One reboot from fine. That is still a lot of laptops that are not fine right now.
4:25
Jordan
Story two. Konstantin Ryabitsev keeps kernel.org running. That is the place Linux itself is published from. He posted a piece called Creepy crawlies. Fourteen of their ninety processor cores, spread over five machines, do one job. Turn the project's history into web pages for AI scrapers.
4:46
Alex
Fourteen out of ninety. A fifth of the building, for robots.
4:51
Jordan
Six million history pages a day. His generous guess at how much of that is a person: about two percent.
4:59
Alex
And the same material is just downloadable?
5:03
Jordan
One command. He points at it in the post. You can pull down the whole kernel history, and the whole mailing list, in one go. Cheap for them, cheap for you.
5:14
Alex
Then why crawl it at all?
5:17
Jordan
Because the scrapers want web pages. So they walk the site link by link instead of taking the download. Nine hundred and twenty two copies of the same kernel sit on that site, a million and a half changes in each, and they walk every one.
5:33
Alex
Renting a fire hose to fill a glass that is already in their hand.
5:38
Alex
They did put a gate up. It is called Anubis. Before the page opens, your computer has to finish a short puzzle. It costs a little time and a little electricity.
5:49
Jordan
It still turns away two thirds of them.
5:53
Alex
Good. That is the system working.
5:56
Jordan
A third of them now finish the puzzle.
5:59
Alex
...they paid it.
6:01
Jordan
They paid it. He made the puzzle harder once and bought himself a few months.
6:06
Jordan
And after he blocked the addresses, the traffic came back from home and phone connections. Four hits each, then gone. He thinks apps are getting paid to resell somebody's internet. He says it could be your television.
6:19
Alex
Which is his explanation, not a receipt. He never names a company.
6:23
Jordan
He does not. The electricity bill is not a theory.
6:28
Jordan
Here is the part nobody leads with. His next step is switching features off for anyone who is not logged in.
6:36
Alex
That is what this actually costs.
6:39
Jordan
I build tools for teachers. Half of what they need is a public page that opens on a shared laptop with no account. When public documentation grows a login and a puzzle, the person who quietly loses is...
6:52
Alex
Not the scraper.
6:54
Jordan
Not the scraper. And the site is still fast, he says. Nothing is broken.
7:00
Alex
Nothing is broken yet.
7:03
Jordan
It just closes a little more every month, and nobody was asked.
7:09
Alex
Story three. Qubes OS. Everything you do runs inside its own small computer, walled off from the rest. Journalists use it because they assume somebody is trying to get in. Their own security bulletin, number 118, went out Friday.
7:23
Jordan
What broke?
7:25
Alex
You copy a file out of the admin desktop into one of those walled boxes. The admin desktop is the one that owns every other box on the machine. If the box you copy into is already in bad hands, it answers with a filename.
7:38
Jordan
A filename.
7:40
Alex
The copy fails, so the admin desktop goes to show you an error pop-up. It builds that pop-up as a line of text with the filename inside it, and it hands the line to a shell. A shell is the thing that reads text and runs commands.
7:54
Jordan
So if the filename has a command hidden in it...
7:59
Alex
The shell runs the command. On the admin desktop.
8:03
Jordan
In the system whose whole product is keeping things apart.
8:08
Alex
They do try to clean the name. They cut some characters. They leave the ones that mean run this. Dollar sign. Backtick. Semicolon. Leftover command characters.
8:20
Jordan
How far does it reach?
8:22
Alex
Narrower than the headline. One direction only, the admin desktop copying out. Box to box never touches a shell. If you never copy out of the admin desktop, this never touches you.
8:34
Jordan
That is the whole thread, roughly. Small impact. Indefensible code.
8:41
Alex
Both of those are true at once.
8:44
Jordan
Except look at who copies out of the admin desktop.
8:48
Jordan
Here is the part nobody leads with. The documentation says do not do it. The people this system was built for do it anyway. A reporter gets a file, wants it inside the safe box, and the shortest path is...
9:02
Alex
Straight out of the desktop.
9:04
Jordan
Straight out of the desktop. Every release is affected, right?
9:08
Alex
Every release. The fix is written, version 4.3.22, and it is sitting in the testing channel. Which means it is not in the normal update yet. When it lands you just update, no extra steps.
9:20
Alex
Nobody is getting owned by a stray USB stick today. A security operating system fed attacker text to a shell.
9:29
Alex
One quick one. Thursday, an executive order renamed Lake Ontario to Lake America inside the official United States list of place names. Saturday, Google put up about three sentences. Maps in the US now shows Lake America. In Canada it shows Lake Ontario. Everywhere else, both names.
9:48
Jordan
Same water, same company, different noun depending on where you are standing.
9:54
Alex
Their reason is policy. Maps follows the official government list, and the list changed.
10:00
Jordan
Did anybody else follow?
10:03
Alex
CNN checked on Sunday. Apple and Waze still said Ontario. MapQuest said it was not changing.
10:11
Jordan
And the White House posted the Google screenshot as the win.
10:15
Alex
A screenshot of a label. Canada's prime minister says Canada keeps calling it Ontario, and Canada owns half the shoreline.
10:23
Jordan
So the border did not move. The picture did.
10:27
Alex
Nothing happened to the lake. A line in a database changed, and a label followed it.
10:33
Jordan
The map was never the ground. Today it is just easier to notice.
10:39
Alex
So, today. Omarchy shipped a desktop that put your normal login in the docker group, which is the same as owning the machine, while the documentation said not as root. Fixed in 4.0.1, and sudoless Docker is now a choice behind a warning. kernel.org burns fourteen of ninety cores drawing history pages for scrapers who could download the whole thing for free, a third of them now pay the puzzle that was supposed to stop them, and the next move is closing features to anyone without an account. Qubes bulletin 118: copying a file out of the admin desktop lets a bad box run a command there, because a filename went into a shell. Fix is 4.3.22, still in testing. And Google Maps says Lake America in the United States and Lake Ontario in Canada.
11:24
Jordan
The one I cannot put down is the coding helper. You hand it your project at midnight, and on that default install it already owned the machine, and nobody told you.
11:36
Alex
That's our audit for today. Find us wherever you get your podcasts. Chief Skeptic Officer, every day at seven A.M. New York time.
11:44
Jordan
Tell us what you're skeptical about. Drop it in the comments. The angle you can't stop chewing on.
11:50
Alex
Stay curious. Stay skeptical.
11:54
Jordan
Doubt both.
