1Password wades into a right-wing mess after funding a Linux project
1Password faced immediate backlash from customers this week over a $300,000 pledge in support of a Linux distro created by David Heinemeier Hansson, who has regularly published overtly racist blog posts that include comments calling for deportation of ethnic minorities in Europe. The popular password manager is now a “distinguished corporate patron” of Omacom, the nonprofit foundation that oversees a popular Linux distribution known as Omarchy.
well this became very long. but if you consider how is the synchronized file treated by the clients, as the main database or just a file known to be shared, then it can be figured out. but always verify your theory in practice, and check the docs of your clients if they have anything to say about synced databases.
Nonetheless, it seems the company has sacrificed a moral position for a “mission-driven” position. In the same message to staff, Faugno says “the scale and growth of [Omarchy’s] use among our customers is significant - Omarchy has grown to be the second most used Linux distribution among 1Password users."
I didn’t know Omarchy existed until, like, yesterday, so this is surprising. Do 1Password users just tend not to use Linux, so second place isn’t many users?
They have repos now, but nothing in them is too advanced, and they absolutely do not deserve the money. GNU/Linux Mint offers THREE great desktop experiences, which are not kitsch slop (even if you don’t like them, they’re very high-quality) and have a much smaller budget.
You can hate DHH, but that’s a straight up lie. They have repos, custom packages. They have an ISO installer, mirrors, even a custom kernel. If that’s not a distro then what is?
that’s right, vaultwarden is the server. It’s not a bad idea to host it yourself, but this is kinda a critical service, and the clients are not too good in keeping the data accessible if the server goes down. so, choose wisely. there are also unofficial public bitwarden servers you can use. if that sounds better, choose one that hosts multiple services and has a community around it, those have a better chance of being kept alive.
My thought process is that I set up the server on my home computer as the main base, and have that occasionally sync to my other devices such as phone and laptop, and sync back to it if I do any changes in those. The remote devices should have local database because my main computer will not always be online.
How feasible is that and how easy is that to set up?
Or should I just set up keepass instead since IIRC that’s one of the ways it can be set up.
The remote devices should have local database because my main computer will not always be online.
yeah, about that. none of the official bitwarden clients allow editing if the server is not accessible. they didn’t want to have to deal with conflict resolution
Or should I just set up keepass instead since IIRC that’s one of the ways it can be set up.
sounds like a better idea. but synchronization wise, conflict resolution has to happen somewhere. like when you edit an entry on two devices, and later they try to sync both changes at once. Fortunately tye keepass format has a more comprehensive entry edit history than bitwarden, so clients can figure it out.
keepassxc on linux supports something called keeshare, check how is compatibility for that with your mobile keepass app. original keepass on windows supports some kind of automatic merging on saving and loading, maybe keepassxc does that too? if you end up using synthing, conflicts could occur at that layer, which is not hard but not so straightforward to handle, but keeshare is supposed to help with that I think.
Yeah, I feared that bitwarden might not like that with my scenario.
I’ve been putting off keepass ever since I found lastpass all those years ago and then learned about keepass. I guess I have to dedicate a weekend some time reading and setting everything up keepass between my Linux home base computer, android phone and grumble Windows work laptop.
if you have an always available central storage, and your keepass clients are never offline when you want to use them, I recommend to use that for storing the database file. but this is rare, and things can go wrong such that this central storage is not accessible, like network breaking down.
Otherwise, devices are online at different times, I would recommend using Syncthing, and then all devices can upload/download the database file when they see each other.
when using synthing, you’ll likely get into file conflicts, though. but it is predictable when will it happen, and you can avoid it if you are careful.
lets say, you edit the database on your phone, syncthing on it is sleeping for energy saving, you turn on your computer and you edit the database there too. then computer is kept running, and later the syncthing app on the phone wakes up. syncthing will see that the database file has changed on multiple devices, in a different way, and you will have to choose which one to keep.
if you can’t use keeshare of keepassxc, you’ll be holding your primary database on the syncthing folder. you will lose the changes made on one of your devices, depending on which one you discarded. but syncthing should save the discarded version with a special name, and I think, but you should check, the desktop version can handle this: if it has the database opened and unlocked, and you discard the local version in syncthing on your PC, resaving the database in keepass should merge the changes and no data is lost; if you have edited the same field of an entry on both devices, both values will be in the entry history. if this works this way, the conflict backup made by syncthing is nt needed.
if you can use keeshare, I believe discarding any of the versions in syncthing should fix it up eventually without data loss, because keeshare maintains a copy of the DB where your client can look for the “global state” of the DB, and always add anything to it that it deems to be new local changes not yet present in the global state. but the global state will only get eventually fixed up if all your devices will keep being able to sync to it; because if in the above scenario on your desktop you discarded the updated global state coming from your phone, to be able to accept the updated global state coming from your desktop, later your phone’s syncthing needs to be able to receive the global state you accepted elsewhere, potentially you will need to accept the remote changes here, then your keepass app needs to open the local database, process the global state database (updating it again with the local changes), and sync it to at least one other device (conflict free if there were no changes elsewhere in the meantime).
I don’t know how deletions are handled by keeshare. if it does not keep an index of deleted entries, then keepass on your local devices will keep readding the last version of this entry. that’s likely fine if it is only added back to the trash folder, and all devices know to delete it after a certain time being there.
Thank you for taking the time to type all that. I’ll have to save it somewhere more safely and five or another read when setting up keepass.
I’ve used syncthing before; testing a rudimentary one way syncing images from my phone and laptop to my main PC; and it was okay learning and understanding it.
now we need a fork for their shitty clients that have unreliable offline functionality and were on an EOL Electron for like 3 months, and for rbw which hasn’t been updated in ages and has compatibility issues with bitwarden.com now
I hope someone makes a replacement rather than a fork, i reallly hate Electron, we need to hope for a fork of the browser extension too
(Before anyone says anything: yes i thought of making it myself but i don’t really have expirience in security stuff and fluff so i’d rather wait for someone expirienced to do it)
Agreed, Electron has so much weird behavior and is a bloated slow mess. My latest annoyance with Electron is that it has the keyrings hardcoded to the desktop environment instead of going through the proper DBus APIs which of course breaks on my own desktop environment and I have to add a flag to all of my Electron apps to work around this.
I feel like this has to be made up, downstream repack distros almost never show up on the top 10 usage stats. You will always see Ubuntu way ahead of Kubuntu.
Not to mention 1Password is a pretty popular enterprise app and I have yet to see some insane sysadmin actually roll with arch as their distro of choice. Most are probably on RHEL or some other enterprise derivative.
I said somewhere else that giving money to a distro won’t even have an ROI, but I didn’t know about this. If the distro is promoting their product that’s a whole other thing.
That piece of information seems like key context. 1Password didn’t just give money simply because they like the product. More or less, it’s product placement in return for funding.
Of the items listed in your link, only the second one seems problematic, in that I wish they had discovered the (non-password but still privacy related) issues first. Even that section acknowledges all of the issues are fixed. The only section that makes it sound like there is still a problem is the last one, which states that version X still contains the vulnerabilities, but in reality that’s just how versions work. Patching a vulnerability creates a new version.
Is there ANY record of passwords being leaked from 1password because of their own lack of security??
lol what. 1Password literally has one of the best security records out there. They’re the ones actually inventing new more secure ways of doing things. The fact that those are all of the issues over the years and they’re one of the most popular pw managers on the planet is pretty indicative of how strong their security actually is. And they’ve never had a password breach, unlike lastpass.
One that does not care at all about having maintaining a sane and open ecosystem. Where there’s money to make, they will prey down quickly. Now that people are somewhat convinced that Linux based systems can work and actually attract the general public, a whole new market is ripe for reaping.
Because there are multiple Linux options, once the commercial versions flood in, the most marketed will grab the biggest share of the uninformed populace.
So obviously the billionaires want to wrestle control over it.
Why does this shit distro deserve all this funding and support? There’s many better options doing a lot more for the ecosystem yet this gets the attention. It’s don’t understand.
I think we all know why. Whether having money causes racism, or it just so happens that racists are the ones with the money and they’re good at keeping it “In The Family” so to speak is kind of tangential and academic. It’s the hateful bigots that have the cash to fund big things, so if you want funding, it pays to be trashy.
I think we all know why. Whether having money causes racism, or it just so happens that racists are the ones with the money and they’re good at keeping it “In The Family” so to speak is kind of tangential and academic. It’s the hateful bigots that have the cash to fund big things, so if you want funding, it pays to be trashy.
Bundling of their stuff into the base installation, I suppose. With simple math, if 1password gets like 33k subscription payments, that’s about $100 000 already.
Omarchy got perhaps a 100K installations just last month.
They’re buying customers and visibility with a sum that’s probably pocket change for them.
I think proton dodged a bullet as the comment of the CEO was only not okay, but not like super bad. But if you funnel 300k to a openly racist idiot, that’s super bad. Same with Mullvad. As soon as money flows, you are immediately batshit crazy.
It’s virtually unknown in the Linux world too. It’s literally something they made up overnight and are trying to astroturf.
I’d say “what a time to be alive” to see the day someone considers it worth astroturfing a Linux distro, except there’s probably some nefarious shit behind it.
I’ve seen a handful of videos about it recently that have been pushed into my algorithm. There’s definitely a campaign to get it out to influencers. Never heard of it prior to this week.
It’s just a fork of Arch, with tiling, that’s been slop coded with AI. Something anyone could recreate without AI in a couple hours if they’re familiar with Arch.
It’s not even a fork or an actual distribution or anything. It’s just Arch Linux with a bunch of dotfiles made using AI and some pre-installed packages.
I only know of it because I was on Distro Watch this week looking for top mention distros I never heard of. The mentions position is likely because of this donation. lol
I’m not OP but yeah, basically. People who are passionate about a specific topic will know what’s up in that area.
I can name half a dozen of the most popular Arch-based distros off the top of my head because… they’re actually well-known. Meaning they’ve been around for years, I’ve used several personally and can argue their pros and cons, and they feature prominently in objective lineups like the Steam Hardware Survey. Omarchy is none of these things.
I’ve heard the name but have not spent the time to find out what it is. I thought it was some immutable distro. I think the same about bazzite and catchy (sp?) which are other distros I see mentioned from time to time and believe are immutable and flatpak-y and that’s all I know. I realise I’m just one data point but I never see a lot about these sorts of distros in my general browsing.
I don’t use password managers and I’ve never been exposed.
If your password is 16 characters with a letter, number, symbol, and is more than 1 word it will take millions of years to brute force. Just use multiple passwords and change the important ones every few months in case of data breach and you’re golden.
Forgot your password? If you have access to an email with multiple 2-factor you can recover any account in about a minute.
Then you forgot the whole point of password managers which is having a place to store all your credentials, what you said are not reasons to not use a password manager but rather some good practices that you can use alongside a password manager lol
Having all of your credentials stored sounds like a detriment and a pointless amount of trust for a shady group like 1Password who conspire with literal fascists.
This is why I’ve not used one. The whole point of passwords is privacy, yet people put them all in one place controlled by someone else where you have no way to verify how secure they actually are. And you need a password to get into it, so now there’s one password that could be breached to gain access to everything.
But why? The user said it was stupid to keep them all in one place controlled by somebody else, and if keepass never updates then that is its own can of worms. You would literally be better off with sticky notes than that because then at least attackers have to be present locally.
I literally never talked about 1password, they aren’t the only password managers nor you need a password manager on the cloud (look at KeePassXC), I currently use Bitwarden because i need to be able to sync the password on multiple devices but in the light of what they are doing, I probably need to start hosting a Vaultwarden instance…
Youtube has been feeding me Omarchy video lately, it seems like every single one I tried to watch brought up using Grok. I don’t know anything about Omarchy, but it was enough to give me the feeling something wasn’t right.
It is currently more than that, and it even has its own repos/mirrors, but the fact that basically every rich person is throwing money at this project should be a huge warning sign to everyone to avoid this.
But at the end of the day, it’s nothing revolutionary. It’s customized Linux with a tiling window manager, all funded by billionaires and developed by a turbo racist.
How the fuck is Omarchy “popular”? I’ve been on Linux going on a decade, give or take, and I first knew about it when someone here in Lemmy mentioned that Dell and some other shit companies were proton a few millions on it.
It’s popular to a lot of the non Foss tech job devs that want to try Linux after mostly using macOS for Dev work. It comes with keybinds they are familiar woth has a pretty UI by default and is arch base. They probably work for companies that are also right wing so it’s something they don’t care about as much as people in alignment with the Foss ideology.
Compared to today’s mask off fascism in the states the guy behind Omarchy is pretty tame and probably less mask off evil than the people they work for
And is being promoted by other fascists - Lex Fridman - and youtube sloppers like Primeagen. All channels highly consumed by non-techs or techs that follow the hype
Unless you’re the one literally writing the program. It is being developed by other people who at any point in time could have issues. Just saying not saying they do now but it can certainly happen.
Yep. When I say “I use Keepass” what I actually mean is “I use KeepassXC, Macpass, KeepassDX, etc. depending on which OS I’m on at the time” and AFAIK none of those are actually made by the original Keepass developer.
You don’t auto update it, and you store the keys locally, and if you need passwords on a device you use a VPN to access them, I’m not to concerned about updating my manager I’m more concerned about my VPN 😂
They distrust anyone to keep their passwords except to write their own program to manage theirs, or happen to take blind pride in supposed eidetic memory.
The passwords are saved into a vault file. You can choose a different software that is capable of opening the vault. I use keepassXC for example. there’s some variety of programs that can open this filetype, on many different platforms.
You think if the developer bails out, the software will magically disappear from everywhere, leaving you with no way of recovery whatsoever?
Let’s say they decide to pull the plug. Everything you have that’s already running will keep running. Code can be forked (in fact with keepass, it already happened). Data can be exported after the fact. Other software can actually open keepass database file.
You really don’t see the difference between this and “the server stopped sending you your own data, oops”?
KeePass is great, but it needs multi-user, granular permissions and conflict resolution on sync. Sharing with multiple simul users is like trying to work on stone tablets.
Yeah, it’s good for personal use, it’s indeed a reliable keyfob. But I believe there should be a version that works for your use case required for multiple users, and you can fork it then modify.
Configuring a tiling wm is beyond the skills of most people, and of the people who would be capable of configuring it, only a small minority would bother. So there’s some value in bundling all of that into a coherent package.
Things don’t have to be groundbreaking for someone to do it the first time.
morals should stay out of software,the ability to use the software to do anything is one of the benefits of open source licenses even if the creator doesn’t approve of using it to bombpesky former land occupiers.
Ideally, yes, and I would never promote banning Nazis from posting their code. In practice, however, it is usually less bother to go with a creator following an ideology not historically prone to slipping nasty surprises into their products.
Sure, those nasty surprises will be found, it’s the entire point of FOSS, but it always takes time.
Aw man, I use them because they’re Canadian but fuck them, I guess. I wonder how hard it is to switch to another password manager. I’m especially concerned with how passkeys work.
I’ve had success on android with Syncthing. I had it installed on every device I needed the DB on and then a server that was always online to make sure each device had the latest version.
I have an iPhone now and Möbius Sync does not work as well (I think iOS limits background activity). My solution was to access access my DB via ssh (Strongbox has an option for this, Strongbox is KeepassXC but for Apple).
Obviously growing in popularity. That’s what aggressive marketing usually gets you.
If you don’t like that, perhaps consider stop talking about it, and him. Instead, every second day somebody writes an article about “DHH is fascist”. What the fuck do they think the effect of those articles is?
Are people actually so dumb that they think accusing him of fascism will make him disappear? That’s like high-octane clickbait fuel.
I don’t write any articles on him or his dot file collection. The reach of Lemmy comments is close to zero and even more so among the red pilled who know the truth.
The DistroWatch Page Hit Ranking statistics are a light-hearted way of measuring interest in Linux distributions and other free operating systems among the visitors of this website. They correlate neither to usage nor to quality and should not be used to measure the market share of distributions. They simply show the number of times a distribution page on DistroWatch was accessed each day, nothing more.
I’ll just copy-paste the first paragraph in case you or anyone else can’t open it:
The English Wikipedia has decided to stop using archive.today and its related websites. This decision was agreed on after a request for comment with more than 200 participants concluded in February 2026, and is due to multiple concerns, including the site using editors’ and readers’ computers to run a denial-of-service attack and evidence that the website has tampered with some archived pages.
I vaguely remember hearing about that, but when I searched the community to see what other people use the first link I found was archive.is. Replacing that archive doesn’t really seem to have taken off.
You don’t capitalize “windows” unless it’s the first word in a sentence. You capitalize “Windows” because it’s the name of a product. Just like how you capitalize “Apple” because it’s the name of a company.
Sick thing is, you can say the most outrageous shit, and since you have a direct pipeline to billions of people online, you’ll always find some fumb ducks to pay you.
Welcome to the post-MLM economy! You don’t even influence people, you just say what they want to hear, and they’ll influence others for you! Jesus christ.
I know about omarchy and seen that guy interviewed a couple of times. How the fuck am I just now aware he is a nazi? He seemed egotistical for sure, and his contribution to open source is … basically his personal dotfiles? I think that this shit was still completely devoid of extermination of minorities manifestos and hatespeech. But seriously how do you know if someone wants to kill refugees? why doesn’t he say so in the interviews or in the source code so we can know? This is fucked up. A faschist idea would be to keep a list. But omg, if you want to exterminate children that fled from war, please just say so in your dotfiles! Idk why this bothers me so… I really do care if my config was made by a hateful hand even if it doesn’t show
It’s like one of the founders of Mullvad VPN (very very rich OG Swedish hacker from way back when) came out as supporting a serious right wing nationalist party in Sweden a couple months back, he paid them like $500K to make sure they stayed in politics and won.
They are the best VPN, but I’m not coming back once my subscription expires.
What is even happening? Are we seeing something like a return to lead poisoning, but there some chemical in our environment that’s rotting people’s brains the same way but we don’t know about it just like we didn’t know about lead at first?
Thing is with Mullvad is that I know for a fact that they don’t keep logs. The cops raided their place twice and they learned after that that there’s no point. They let them in and do whatever they wanted- they knew they wouldn’t find anything.
That type of trust is hard to come by.
Fuck nazis man, they infect the best of us. Such a copout. I suppose it’s something about… They get sentimental in their old years and remember a country that is no longer there- I feel that shit too, but I don’t get caught up in nationalist cosplay and LARP parties about it, shit changes, we need to fight for it without being fucking nazis. There’s a middle road here I feel.
Sorry, I just got rambling, didn’t mean to, but damn.
I partially blame people with big audiences that keep hyping him up and platforming him. Primeagen interviewed him on YouTube and was worshipping him the entire video. Embarrassing display.
As bad as the “Nazi bar” problem seems to be in FOSS at the moment, it is definitely heartening to consistently see how immediate and overwhelming the pushback has been. I think it says a lot about the community, and it’s a good thing.
Application unique passwords and MFA in the one package. Cross platform so I can use on phone and PC. Costs like $10/year. Also locks the credential and passkey to set URLs so phishing attacks are harder.
It’s FOSS and easy to set up. KeePass simply stores everything in a file and you use Syncthing to sync this file between devices. Syncing is optional, if you just need you password on desktop you don’t need it.
KeePass has pretty bad UX when compared with Bitwarden though. Bitwarden/Vaulwarden is the best solution IMHO but it’s really difficult to set up.
Syncthing is great, but can be a bit of a pain in the ass to set up. I wish they’d make that process easier, and maybe also support sharing the ignore file between the hosts…
KeePass honestly sucks for the most part. I love local vault and hope something better comes along, but KeePass UI constantly gives me issues. I’ve tried KeePassXC and that is what I use still, but being limited to opening a single entry at a time. Additional properties are a pain. It’s author not even understanding the need for using the desktop session for the CLI (requires passing password via the terminal to or having separate key file). KeeShare not working on Android. So many things that Bitwarden/Vaultwarden solves much better and quicker. Sad that Bitwarden/Vaultwarden didn’t make a local SQLite client that doesn’t rely on a server.
It’s so that you can have unique, randomized, rotating passwords for every service you have. Also, they auto fill fields for you, and can save you from spoofed URLs if you’re not paying attention. Highly recommend getting one. Bitwarden is good.
So that every service I use can have a randomly generated, unique password. Therefore if one of them gets hacked and my password leaked, brute-forced, or decrypted, it won’t affect any other service.
Plus it stores passkeys and handles 2fa code generation, keeping them synced on all my devices, and ensures I never have to remember specific passwords because they’re all safely stored in heavily encrypted vaults guarded by the only single password I do have to remember. Also it notifies me if any of my information is in any breaches, or if I could do better to secure my account.
Trust me when I say, it’s safer, simpler, and smoother way to manage things.
Unique passwords and MFA in the one package. Cross platform so I can use on phone and PC. Costs like $10/year. Also locks the credential and passkey to set URLs so phishing attacks are harder.
That feels excessive and I genuinely think y’all are paranoid about how often people are trying to hack you. Been running the same few for like a decade with no issues. Now I have a relatively low online footprint but still, the tech world in general is starting to feel like a form of psychosis.
I do write stuff down. In my password manager so it’s always with me all the time and is much more difficult to gain access to than if I were carrying around a notepad. Also, I ain’t got pockets for that, and I’m not buying a wardrobe of cargo pants.
The hard password you think of are actually very low entropy and easy to crack, the only good ones are random ones, which are hard to remember (except for the random words ones). It’s impossible to remember 200+ totally random password for a regular human
Application unique passwords and MFA in the one package. Cross platform so I can use on phone and PC. Costs like $10/year. Also locks the credential and passkey to set URLs so phishing attacks are harder.
Probably around the time he started writing blog posts about how there’s too many brown people in London, or comparing Romani to invasive predator species?
Being against a few horrible people doesn’t automatically make you a good guy…
Interesting case of how funding decisions can quickly become part of a much bigger conversation around tech, politics, and community trust. It will be interesting to see how this develops.
Keep in mind that internal fights among community discourage users from shifting and benefit Microsoft. I would not be surprised if the smear campaign is a big tech initative.
That’s right. But are you suggesting we just sweep it under the rug and ignore the support of racist people? Because that is what big tech does and not a lot of people like it
He got a recent interview with one of the YouTubers I follow and I’m must say I’m a bit sad to not see people calling him out youtu.be/_CuibYl_Fh0?is=f6p3aQv4iPmdqiH1
Cachyos will forever be the ideal Arch distro for nerds who want the benefits of Arch without the hassle of Arch (until they support some giant racist or soemthing)
