Live data from Hacker News

Ask HN: What do you want to see in Debian 10 (“buster”)?

news.ycombinator.com

111–120 of 329 posts

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#111

Earlier quoted context omitted.

As I understand it, much of that work goes into removing any trace of even innocuous things like libsystemd, which is used by applications that want to support systemd if available. All the necessary work to support a non-systemd init is already in Debian, making Devuan fairly pointless in practice.

That's correct. Debian ships sysvinit as well as systemd and daemons have initscripts/confs for both. A lot of people still use sysvinit and it just works.

If this is really true, I might have to eat my own words.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#112

HEADLINE Remove openssl1.0 DESCRIPTION stretch made OpenSSL 1.1 the default openssl package. Unfortunately, OpenSSL 1.0 was kept around, since so many things depended on it. There should now be enough time that a firm stance can be taken toward not allowing OpenSSL 1.0 in Debian Buster. Once TLS 1.3 is finalized, OpenSSL 1.2 will be released with TLS 1.3 support. Not supporting TLS 1.3 in buster would (in my opinion)…

How would you feel about a switch to one of the forks, such as BoringSSL or LibreSSL?

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#115
post #68

HEADLINE: enable AppArmor by default DESCRIPTION: AppArmor improves security by limiting the capabilities of programs. Ubuntu has done this years ago [1]. I'd like to see profiles for web browsers enabled by default. I think AppArmor is the right choice of default Mandatory Access Control for Debian because Ubuntu and security focused Debian derivatives like Tails [2] and SubgraphOS [3] have already committed to it.…

Yes. This is good one. RHEL by default has active SELinux profile for samba and that's why was not affected by SambaCry. I vote for AppArmour.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#116
- HEADLINE: transactional upgrades and package installs

- DESCRIPTION: This is a feature of the guix package manager. From their website:

"Each invocation is actually a transaction: either the specified operation succeeds, or nothing happens. Thus, if the guix package process is terminated during the transaction, or if a power outage occurs during the transaction, then the user’s profile remains in its previous state, and remains usable."

They also do transactional rollbacks, but I'm not sure how realistic that is for the apt package system.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#117
post #7

HEADLINE First-class init that is not systemd DESCRIPTION I believe it's notorious that systemd is highly controversial, even spinning off a fork called Devuan. It might be more favorable to reunite the community by including one alternative init system that is, fundamentally, a first-class citizen in the Debian ecosystem. "First-class" implies that the user is given a choice on new installations in a specified promp…

What do you dislike about systemd? Do you disagree with the ideas behind it, or is your discontentment more about the specific implementation of those ideas? Can you give examples?

Not the OP, but:

- It's effectively a black box that nobody but the systemd team really understands; and the response by said team to problems with systemd too often defaults to "you're doing it wrong"

- Systemd is not just an init system, it's a message bus, authentication system, logging system, container management system, xinitd system, and any other number of highly coupled systems.

- Service startup order can still be non-deterministic and fairly slow; hard init problems have been made harder, while easy init problems "only" remain easy.

- Unit files can be stored in a minimum of four separate locations on disk, and this can be increased dynamically.

- Failures are opaque, and the failure of systemd triggers the failure of the entire system.

The original idea that drove systemd's creation is still fairly sound: create a simple, deterministic, and parallel init system which is better than initv. The implementation doesn't live up to those goals, and instead of iterating against that goal, the team's focus has shifted to take over all aspects of the Linux runtime which isn't managed by the kernel.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#118

Earlier quoted context omitted.

No, I haven't used unstable myself. But "have you spent the time evaluating it?" is beside the point. My point is that it would be positive to have a Debian release channel with fresh software with 1) explicit security support and 2) naming with positive connotations so that fewer people who don't need to use out-of-date "stable" used "stable" because it is the Debian release channel with the most positive-connotatio…

But what is wrong with stable in the first place ? What you are asking is basically to switch to a rolling cycle with guaranteed support. This is a huge change and also don't account for the fact that many people choose Debian stable specifically because of it's non-rolling cycle...

> But what is wrong with stable in the first place ?

* It's generally unpleasant for a user to know their problem has been fixed but they don't get access to the fix in a long time.

* Users using old software when they don't need to has network effects that give rise to negative externalities. See my other top-level reply: https://news.ycombinator.com/item?id=14580042

> don't account for the fact that many people choose Debian stable specifically because of it's non-rolling cycle

My suggestion is based on the premise that there are users who choose or would like to choose Debian because of its community distro brand equity and not because Debian stable has old software. Also note that I suggested a change in the framing of testing and didn't suggest stable be dropped.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#119

HEADLINE: Easier way to create local packages DESCRIPTION: My first distro was Debian. Then, for a while, I used Arch. But it kept irritating me with its total disregard for backwards-compatibility (symlinking /usr/bin/python to python3), coarse-grained packages (want to install QEMU PPC without pulling in every other architecture as well? too bad!), lack of debug packages (good luck rebuilding WebKit just to get sta…

Look into the equivs package: https://packages.debian.org/stretch/equivs. It's intended mostly for making metapackages, but you can include files as well.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#120
HEADLINE: Day(s) old sid as a rolling distro

DESCRIPTION: I think I represent a number of users. We want to use unstable as a rolling distribution, but we don't want to run into every edge case. Testing doesn't update fast enough and doesn't have as good of security. There's no middle ground between absolute bleeding edge and the too conservative testing.

I used to use unstable but there's that annoying race condition where I could upgrade at the exact wrong time when brand new (broken) package versions were uploaded and not enough time has passed for even the first round of bugs. I'd like a day safety buffer so apt-listbugs has a chance to warn me about catastrophic bugs.

Setting up a true rolling distribution may be too much work for Debian. Actual Debian developers will be running unstable. It would be nice if there was a middle ground for non-Debian developers who want a rolling distribution but don't want to get hit by every edge case in sid.

I think a nice compromise would be to cache the sid packages for a day (or two) and set that up as another branch. A full day of possible bug reports from people on bleeding edge sid would give us a chance at missing the catastrophic edge cases while still being very current.

I think this could encourage more Debian developers. If I wanted to join Debian as a DD, I would need to have an unstable installation somewhere. It wouldn't be my daily driver because I don't want to run into those breaking edge cases. If my daily driver was day old sid, I could have another machine / VM that runs sid and would almost be identical to what my daily driver is running. It's not like testing where packages could be entirely different due to the delay in migrating.

Unlike testing, day old sid would migrate all packages even if there are release critical bugs. There would be no waiting period beyond the strict day limit. If there is a catastrophic edge case, people already on day old sid using apt-listbugs would be able to avoid it. New installations would hit it but you could warn users (see below).

If you make apt-listchanges and apt-listbugs as required packages for day old sid, then people could be informed about what broke on the previous day.

It would be nice to integrate apt-listbugs into an installer for day old sid and fetch the latest critical or high priority bugs before the installation. A new user could then decide if that's a good day to install. Or you could have a simple website that says here's the day old sid installer and these packages currently have critical or high priority bugs. If you would install those packages, maybe wait another day or two for it to settle down.

Maybe day old sid is too close. Perhaps 2 day sid or 3 day old sid? I don't feel that testing fills this role already because testing waits for 2-10 days and won't update if there are release critical bugs. I'm fine with something closer to bleeding edge sid, but I'd really like to allow a few days for the bleeding edge users to report bugs so I can decide whether to upgrade. I don't have an expectation that day(s) old sid is more stable than testing or less unstable than sid. All it provides is a buffer so I can get bug reports and make my decision about whether to upgrade.

DISTRIBUTION: day old sid.

Post reply on HN