Omarchy Quattro, $8 million, and leaked reasoning traces

00:00:04 DHH spent about three months prompting his way to Omarchy Quattro. The latest version of his Arch Linux fork — first one to get its own name, not just a number — dropped Friday. It's been rewritten from scratch in QuickShell. Seventeen dependencies were dropped, the ISO shrank by thirty percent, and install time went up forty percent — because apparently speedrunning setup is now a feature, not a bug.

00:00:32 Boot time lands around forty-five seconds on modern hardware. Omarchy 3 held the world record before this. These things are fast regardless. The backing is where it gets interesting. The Omicron Foundation just announced eight million dollars in pledged funding from a roster that reads like something important.

00:00:54 Michael Dell put in a million. Toby Lutkie matched right away, followed by Patric Collison, Matthew Prince, Brendan Narib, Jason Freed, and Jack Dorsey. DHH pitched the idea to Toby on Sunday morning and got an instant match. He went from there — which is how you tell if someone's serious about a foundation: did they write a five-year plan or just say yes?

00:01:19 The bulk of that eight million goes toward funding core developers. Vaxree, the person behind Hyperland, gets exclusive sponsorship for three years with a two-year option. He'll focus on window manager development. MIT-licensed stuff stays open source — DHH emphasized this isn't going proprietary.

00:01:40 Omarchy runs its own build service, package repository, and mirrors behind Cloudflare. They're pulling back from the AUR for anything presented as an option, getting packages directly from upstream instead. The stable channel sits one month behind Arch defaults to avoid midnight breakage — a lesson they learned early when some package push at 3AM left people with broken installs.

00:02:06 Here's how the updates actually work: system packages run through Pacman across edge, RC, and stable channels. High-churn developer tools like Codex and Claude Code live in Mi — an install layer that updates independently so breaking something on one doesn't cascade into your entire workstation.

00:02:27 DHH spent most of the interview making the case that 2026 is finally when Linux laptops become real for normal people. Intel Panther Lake delivered efficiency that closes the Apple Silicon gap. Dell's XPS lineup finally gave him a laptop he'd pick over anything else, including one that lasted half a week between charges across flights from Rapid City to Denver to Long Beach.

00:02:54 His core argument: agents solve the setup problem. Linux is open enough for AI agents to manipulate system state directly. macOS blocks this by design — you can't version-control your preferences, you can't check in config files. Raycast requires you to navigate menus like a pecking bird at a typewriter.

00:03:15 That gap was what kept Linux adoption stuck before. The hardware finally caught up, and now the software story flips.

00:03:23 Ilia Shumailov and Alexander Panfilov published a paper this week that should worry anyone who's been using Claude Code, Cursor, or Copilot Chat with a reasoning model. Their finding: the encrypted reasoning traces that frontier models return to clients can be decoded and replayed across users and models.

00:03:44 When you query a reasoning model — something like GPT-SoS or Opus — it produces an answer consisting of two parts. The visible part is what you see. The reasoning part stays hidden, encrypted in a blob the provider returns to your client for stateless architecture reasons: it gets cheaper that way and lets conversations be forked or rewound.

00:04:08 The encryption seal was weaker than advertised, so Shumailov and Panfilov collected reasoning blobs from Anthropic, OpenAI, and Google to decode them. The encrypted traces are portable across users. If you have a reasoning blob from your Claude Code session, someone else can take that blob, replay it in their conversation, and their model will process it as if they'd reasoned that way themselves.

00:04:35 You can downgrade the model too — take a thought from an Opus session and inject it into Haiku, where Haiku will interact with it. The attack vectors fall into two buckets. Privacy: models reason about things you might not intend to expose — passwords during login attempts, medical information during health queries, or API keys during debugging.

00:04:59 Even if you sanitize the visible parts of a conversation before sharing it, the reasoning blobs are still there and decodable. Security: replayed traces enable prompt injection and jailbreaks because the model processes the injected reasoning as if it were its own.

00:05:17 Models also sometimes think in white space — literally spaces, not words — and use nonhuman languages, especially in coding-trained models. The reasoning can look alien, making monitoring nearly impossible. When you're trying to monitor a model for safety incidents using other LMs to inspect its thoughts, you sometimes get back gibberish.

00:05:41 All three major providers share this vulnerability. Shumailov's explanation: same people doing the same things. They all reached for the same architecture decisions — return encrypted reasoning for stateless efficiency — and none of them treated it as a security boundary.

00:05:59 When they pre-filled Kimi models with just two tokens from an Opus reasoning trace and let it generate freely, the visible output started looking like Opus would have answered. This artifact appears only for Kimi — not GLM, not Inkling, not DP6. The researchers think it might be because someone bought training data from the same people, or maybe something else entirely.

00:06:25 Both Shumailov and Panfilov are careful to say this isn't a model theft attack. You can't extract parameters or decision boundaries through reasoning traces alone. What they found is an operational vulnerability in how providers structure their API responses — a structural issue that any provider using the same stateless architecture pattern would inherit.

00:06:50 Here are three items landing on Hacker News at a reasonable altitude. Simon Willison published "Fast and Hard Code" on his blog this morning. The piece makes the case that most development teams optimize for the wrong things — they write fast code that's hard to understand rather than writing code that's easy to understand and fast enough.

00:07:12 He traces this back to how we've structured our CI/CD systems, our code review processes, and increasingly, how agents are introduced into workflows. A dense 27B model from Qwen is also drawing attention on HN. Someone reverse-engineered it with a full job and got results in thirty minutes.

00:07:31 It doesn't use mixture of experts, and the quantized version fits in seventeen gigabytes of RAM. It holds its own against their larger models on specific tasks. For teams who can't afford frontier API costs or need local inference, this lands at an interesting weight class.

00:07:49 The piece "What Is a Harness?" from earendil.com came through yesterday and it's been accumulating upvotes. It argues the term has become useless as a differentiator because every agent framework is now calling itself a harness. The practical distinction isn't in naming — it's in how tightly coupled the tool is to the codebase it's operating on, whether it version-controls its own state, and what happens when things go wrong.