Concerns about 1Password funding going to Omarchy
I’ve been a user (and recommend-er) of 1password for several years now (over 7, apparently!). Recently though, there was some related news that seemed rather...concerning:
https://omarchy.org/news/2026/08/1password-and-37signals-become-distinguished-corporate-patrons/
*At a glance*, this is just 1Password giving money to a Linux distro—which is, in isolation, a good thing! But I’m not sure if *this* particular distro is the one that should have been used.
Omarchy is a security mess. 4.0 included some absolutely horrifying security issues, due to an over-reliance on AI-generated glue scripts that did not bother to safely pass values around: https://blog.happyfellow.dev/merchants-of-insecurity/
The 4.0.1 changelog (https://github.com/omacom/omarchy/releases/tag/v4.0.1) includes fixes for:
- Command injection via video titles
- Bash injection via notifications
- Lua injection via USB device names
- Command injection in the `sudo reset` helper
- Privilege escalation via path injection, due to helper scripts that inherited the usual path but are configured as NOPASSWD in sudo (??)
- Privileged tools saving world-readable/-writable temporary files for managing credentials into fixed paths under /tmp
This is rather horrifying! I understand that both humans *and* robots make mistakes, but this set of issues does very much reek of lack of attention to security, and many of the bugfixes just strap sanitization / validation on top without bothering to re-think the fundamental approaches taken (e.g. https://github.com/omacom/omarchy/pull/7847/commits/49e870c9fd7812709c0ad97cd8851d4514a492bd and https://github.com/omacom/omarchy/pull/8129/commits/a73351a86a0fdaa5387995a36ea43d49a9048d21).
Additionally, Omarchy itself is a downstream of the well-known Arch Linux. Should the upstream here not be the recipient of at least *some* of the plentiful funding the downstream has received as of late? All the core things like kernel maintenance and security bugfixing are still the job of Arch.
Now...I will tread into perhaps the more contentious parts of this (oh noes! politics!): DHH is a right-wing racist. This has been documented elsewhere, but I will point to this single article that has a good breakdown of one of “problematic” posts: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/
DHH writes:
> London is no longer the city I was infatuated with in the late ’90s and early 2000s. Chiefly because it’s no longer full of native Brits. In 2000, more than sixty percent of the city were native Brits. By 2024, that had dropped to about a third. A statistic as evident as day when you walk the streets of London now.
The article points out that the “a third” is *not* referring to “native brits” but rather, specifically, those who are *white*:
> 59% of Londoners were born in the UK! How could it possibly be that only a third of them are native Brits?
> The article’s first section breaks down the demographic data in a table. The first ethnicity listed? “White British” at 36.8% as of the 2021 census.
Not good! The article continues to break things down in more detail, and I’d encourage anyone who wasn’t aware, or perhaps is skeptical of these details, to read it fully. Various other articles have compiled more Questionable Moments, such as:
- https://blogs.gnome.org/alatiera/2025/11/06/dhh-and-omarchy-midlife-crisis/
- https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem
These include links to more posts on things such as “ADHD is fake” and “Elon Musk & DOGE are good for the US” (lol that aged well). It gets weirder the more you dig!
You could say this is all off-topic. What do the political views of one person have to do with 1password? But that brings me back to the link that started this all:
> 1Password and 37signals are each contributing $100,000 a year for the next three years, which takes the foundation’s funding to $12.6 million.
$300k!! Do you know how many open-source projects that Linux is built on could use that much money? How many of the projects that Omarchy indirectly depends on? Instead, that money goes to the person who uses his same Twitter he mostly posts Omarchy updates on to *also* talk about his above-mentioned Questionable Content.
Ultimately, I’d really rather not have the money I’m paying for a password manager go to this. There are so many better things out there, that don’t come with the primary flag-bearer talking about the increasingly-diverse racial makeup of a city as if a tragedy, and have an attitude towards security that’s about as cohesive as swiss cheese. Thus, I’d implore the people at 1password to reconsider this decision, with the full context that I outlined above.