What's this about?
Omarchy announced 1Password and 37signals as Distinguished Corporate Patrons — two days after the disclosure that its default configuration let any process in the user session escalate to root without a password.
Why is the juxtaposition the story?
Because one of the two new patrons is a password manager. There is nothing improper about the timing — the security issue was responsibly disclosed and patched in 4.0.1 before publication, and sponsorship deals take longer than two days to arrange. But it is a reminder that corporate backing is a signal about relationships, not about security posture, and the two get conflated constantly when people choose what to run.
What's the community saying?
HN 55 points, 99 comments — a very high comment-to-point ratio, meaning argument
- Much of the thread is about the project's leadership rather than the sponsorship, which is where Omarchy discussions have gone all week.
- The security-minded reading: patronage is a good thing for a young project, and it changes nothing about whether the defaults are safe.
- Worth pairing with the 0xcc disclosure from two days ago rather than reading either alone.