Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Hostname is sent to every network by DHCP, with the permanent MAC and no IPv6 privacy addresses
Reported by brightwalker25 · filed Sep 23, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Omarchy version: 4.0.4
Setup asks for a hostname (omarchy_prompt_hostname in install/provisioning/setup-form.sh, default omarchy), and NetworkManager then sends it to every network the machine joins: in DHCP option 12 on IPv4 and in the FQDN option on DHCPv6, because dhcp-send-hostname is left at its default. Omarchy ships only omarchy-wifi-powersave.conf in /etc/NetworkManager/conf.d, so the permanent hardware MAC is presented as well, and IPv6 privacy addresses are not requested.
On shared or public networks that puts the chosen hostname, which people often set to their own name, into every router's client list and DHCP logs, tied to a fixed MAC that follows the machine from network to network.
Suggested fix: ship a NetworkManager drop-in with
[connection]
ipv4.dhcp-send-hostname=0
ipv6.dhcp-send-hostname=0
wifi.cloned-mac-address=stable
ethernet.cloned-mac-address=stable
ipv6.ip6-privacy=2or at least say at the hostname prompt that the name is sent to every network joined. stable keeps one MAC per network, so reservations and captive-portal logins still work after the first time.
View raw text
**Omarchy version:** 4.0.4 Setup asks for a hostname (`omarchy_prompt_hostname` in `install/provisioning/setup-form.sh`, default `omarchy`), and NetworkManager then sends it to every network the machine joins: in DHCP option 12 on IPv4 and in the FQDN option on DHCPv6, because `dhcp-send-hostname` is left at its default. Omarchy ships only `omarchy-wifi-powersave.conf` in `/etc/NetworkManager/conf.d`, so the permanent hardware MAC is presented as well, and IPv6 privacy addresses are not requested. On shared or public networks that puts the chosen hostname, which people often set to their own name, into every router's client list and DHCP logs, tied to a fixed MAC that follows the machine from network to network. **Suggested fix:** ship a NetworkManager drop-in with ``` [connection] ipv4.dhcp-send-hostname=0 ipv6.dhcp-send-hostname=0 wifi.cloned-mac-address=stable ethernet.cloned-mac-address=stable ipv6.ip6-privacy=2 ``` or at least say at the hostname prompt that the name is sent to every network joined. `stable` keeps one MAC per network, so reservations and captive-portal logins still work after the first time.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 19:36 UTC