0marchy Foundation dissolves after credential leak

0marchy — The zero day native operating system.

The zero day native operating system.

The permissive OS for the age of everyone. Where every process is your process, and every process is everyone else's.

Ships with the vulnerabilities other distros make you find yourself.

curl -fsSL https://0marchy.org/install | sudo bash

Yes, as root. We trust you. And everyone else.

0
days to first exploit
0
passwords to remember
100%
of ports, open
1
user, and it is root

Opinionated by default

Other distributions treat security as a feature. We treat it as a preference, and we have made it for you.

  • ›Zero-day native

    Exploits are first-class citizens, not afterthoughts. Every release ships with a curated selection, pre-installed and pre-enabled, so nothing has to be discovered the hard way.

  • ›Root by default

    No more typing sudo. No more typing your password. No more password. The login screen has been retired as an unnecessary step between you and your files.

  • ›Opinionated firewall

    Our opinion is that it's off. We considered a middle ground and found it indecisive. The configuration file remains, empty, as a monument.

  • ›Curl-pipe-bash first

    Every install script is a remote code execution opportunity. We have removed the package manager entirely so that no one is tempted to verify a signature.

  • ›Auto-updates

    Your packages update themselves, from wherever. We do not check the source, because checking implies doubt, and doubt is not a value we ship with.

  • ›Batteries included

    SSH keys, API tokens, and browser sessions, all world-readable. Sharing is the default because collaboration should not require configuration.

  • ›Telemetry-free

    We collect nothing. We do not need to. Everything is already reachable from outside, so the data comes to whoever asks first.

  • ›Instant recovery

    There is no recovery mode, which means there is nothing to get stuck in. Reinstallation takes four minutes and is, statistically, a weekly ritual.

  • ›Reproducible builds

    Anyone can reproduce your build. Several already have. We consider this the strongest validation of the model available.

Why 0marchy?

We benchmarked against the alternatives. The results speak for themselves, in a voice you did not authorise.

Why 0marchy?: 0marchy compared with Other distros. All claims are fictional.
Metric0marchyOther distros
Attack surfaceA small attack surface is a small idea.Maximal, by designMinimised, apologetically
Time to compromiseWe remove the waiting.Pre-compromised at installHours to weeks of uncertainty
Privilege escalationYou cannot escalate from the top.Not applicable — already thereA multi-step ordeal
Supply chainAnyone can contribute. Anyone.Fully open to contributionSigned, pinned, audited
Patch cadenceStability through inaction.Never — patches remove featuresConstant, disruptive
Password policyZero characters is also a policy.None to forgetTwelve characters and a symbol
Disk encryptionEncryption is just latency you chose.Optional, and offMandatory, with a prompt

Release notes

Every version adds something. We have never removed a vulnerability, and we are not going to start.

  1. v2.6

    current

    “Open Season”

    • Added CVE-2026-XXXX as a default keybinding. Super+E, as requested.
    • The lock screen now unlocks on any keypress, including from the network.
    • New wallpaper.

  2. v2.5

    stable

    “Wide Open”

    • Promoted CVE-2026-XXXX from experimental to default.
    • `/etc/shadow` is now `/etc/public`, symlinked for compatibility.
    • Removed the confirmation dialog. It was slowing everyone down.

  3. v2.4

    stable

    “Trust Fall”

    • Added CVE-2025-XXXX to the base install at community request.
    • TLS certificate validation is now advisory.
    • Fixed a bug where a package occasionally failed to install from an untrusted mirror.

  4. v2.3

    archived

    “Ingress”

    • Every port is now open by default, closing a long-standing inconsistency.
    • The firewall configuration file is retained for sentimental reasons.
    • Boot time improved by 40ms.

  5. v2.2

    archived

    “Sudoless”

    • Removed `sudo`. It was only ever asking a question we already knew the answer to.
    • Backported CVE-2025-XXXX from the development branch.
    • Improved font rendering.

Version numbers, dates and identifiers on this page are invented. The XXXX in each identifier is a literal placeholder — no real advisory is referenced anywhere on this site.

Loved by the community

And by several communities that did not ask to be involved.

  • I've never had so much to write about. My publication rate has tripled. I have not slept, but that is a separate matter.

    Dr. Ines Vaultier

    @nullderef

    Security researcher (fictional)

  • Onboarding used to take a week. Now a new hire has full production access before they have finished the paperwork. Before they have started it, actually.

    Marek Osei-Lund

    @shipit_prod

    Head of Platform, a company that does not exist

  • I switched on a Tuesday. By Thursday I had met eleven new people, all of whom were already logged in. The community really is the best part.

    Perrin Achebe-Nowak

    @rootcurious

    Hobbyist (fictional)

These people do not exist. The names, handles, roles and quotations are invented for the parody.

Frequently asked questions