Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

11–20 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#11

Post by jdbernard »

bananapub wrote: post #5
PlutoIsAPlanet wrote: post #2

IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

The problem is that this will break all existing users who use those features when they update. One of the comments in the GitHub thread has a better path, IMHO: ship two new packages, a -minimal and a -full, and the user to choose, rather than silently break functionality (NEWS is fine, but not really read by user as everyone admits).

Re: KeePassXC Debian maintainer has removed all network features

#12

Post by JohnTHaller »

bananapub wrote: post #5
PlutoIsAPlanet wrote: post #2

IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

The default package should be named keepassxc-debian-limited or similar and the proper package should be keepassxc

Re: KeePassXC Debian maintainer has removed all network features

#13

Post by nulld3v »

bananapub wrote: post #5
PlutoIsAPlanet wrote: post #2

IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

But that's not what they disagree with. They are saying you shouldn't have a package called "keepassxc" if it is missing a ton of features from upstream KeepassXC. You should name it something different instead.

So you shouldn't have "keepassxc" and "keepassxc-full". Instead you should have "keepassxc" and "keepassxc-minimal".

Re: KeePassXC Debian maintainer has removed all network features

#14

Post by bananapub »

milliams wrote: post #9
bananapub wrote: post #5

Earlier quoted context omitted.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

As stated in the GitHub thread [1]: You fundamentally misunderstand our program when you use the word plugin. These are built in features, not plugins. The features can be enabled as desired by the user and they come disabled by default. This change to not compile and ship these features in the base keepassxc package does nothing besides create angry (or confused) users. [1] https://github.com/keepassxreboot/keepassx…

that seems completely irrelevant?

plugin, compile time ./configure flag, whatever - package maintainers extremely routinely create multiple versions of a package for various reasons, from security (this case) to dependencies (Debian contains a emacs-nox package that is emacs compiled without X libraries to avoid dragging them in on servers, for example) to license reasons.

again, all of the complaints are literally about the change, which the maintainer has decided to do in a disruptive fashion.

Re: KeePassXC Debian maintainer has removed all network features

#15

Post by theamk »

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1].

Remember, the full network-enabled package is present in debian as well - so all the network features are "apt install keepassxc-full" away, for users that want it.

Two minor comments: calling your upstream "crappy"[0] is probably not the most productive way for package maintainer to act. Also, I am not sure if the package names (keepassxc vs keepassxc-full) are best for Debian users - something like keepassxc-lite and keepassxc-full might be more informative.

[0] https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

[1] https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

Re: KeePassXC Debian maintainer has removed all network features

#17

Post by bananapub »

JohnTHaller wrote: post #12
bananapub wrote: post #5

Earlier quoted context omitted.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

The default package should be named keepassxc-debian-limited or similar and the proper package should be keepassxc

OK? that has nothing to do with what I was correcting:

> IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version.

the downstream maintainer didn't "change a package in a way that doesn't have the intent of the upstream project", they altered the config flags in one package and made another with the previous flags. the maintainer is being a dick, but not in the way the OP suggested.

Re: KeePassXC Debian maintainer has removed all network features

#18

Post by lupusreal »

okl wrote: post #4
HieronymusBosch wrote: post #3

For folks interested this issue on GitHub seems to have the latest comments. https://github.com/keepassxreboot/keepassxc/issues/10725

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…

[flagged]

Re: KeePassXC Debian maintainer has removed all network features

#19

Post by nulld3v »

lupusreal wrote: post #18
okl wrote: post #4

Earlier quoted context omitted.

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…

[flagged]

They removed other non-networking features too. E.g. even autotype was removed. At that point why not just store your passwords in an encrypted notes app?
Post reply on HN