Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

81–90 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#81

Post by petee »

cjk2 wrote: post #72
thaumaturgy wrote: post #62

Earlier quoted context omitted.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

I think you'd have to actually ask the users about that. Not make assumptions based on some loud people on a Mastodon thread. What the user is given here is a choice.

But they already had a choice, since the removed options were disabled by default.

This really just breaks core functionality that exists and is expected by real users, under the guise of unnamed security risks...theres plenty of disabled options in Linux that are "potential" risks, so its a silly choice.

Re: KeePassXC Debian maintainer has removed all network features

#82

Post by cjk2 »

worble wrote: post #79
cjk2 wrote: post #72

Earlier quoted context omitted.

I think you'd have to actually ask the users about that. Not make assumptions based on some loud people on a Mastodon thread. What the user is given here is a choice.

Well no, what the user is actually being given is a completely different application than the original one they downloaded, which is now increasing the maintenance burden upstream because THEY are they one getting all the bug reports because Debian decided to swap the packages out from underneath their users: https://github.com/keepassxreboot/keepassxc/issues/10725#iss... > This is now our fourth bug report because o…

It's not completely different. They patched stuff out.

And I, as an end user, am absolutely fine with that, as a user of vim-nox package etc etc...

Re: KeePassXC Debian maintainer has removed all network features

#83

Post by WesolyKubeczek »

bananapub wrote: post #5
PlutoIsAPlanet wrote: post #2

IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version.

not sure why you're commenting without even reading the linked 200 character post? the maintainer has enabled all plugins (including network stuff) in the keepassxc-full package, the keepassxc package will be just the basics with a much better security posture. that's obviously completely fine and completely within the remit of a maintainer, the entire complaint is about this being a change .

Because I run and upgrade and suddenly all my shit stops working without warning, that's why. It's not how things should be done.

Re: KeePassXC Debian maintainer has removed all network features

#85

Post by bananenpubs »

charles_f wrote: post #33
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

He removed not only networking but support for yubikey, and autotype. These are all features that are turned off by default.

> and autotype

I would go crazy w/o autotype. The way the IT dorks were forced by management to set up 'SSO' via an external provider at work, you have to enter the same information at least 3 times a day. 'SSO' for management means 'sign into each of our tools each single day'. Muh, no work done equals better security!

Re: KeePassXC Debian maintainer has removed all network features

#86

Post by thaumaturgy »

cjk2 wrote: post #72
thaumaturgy wrote: post #62

Earlier quoted context omitted.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

I think you'd have to actually ask the users about that. Not make assumptions based on some loud people on a Mastodon thread. What the user is given here is a choice.

Users should be asked if they actually wanted the features in the existing package after all? Why shouldn't users have been asked before changing the existing package?

I'm one of those users. If I'm loud, does that mean my opinion doesn't count anymore?

Re: KeePassXC Debian maintainer has removed all network features

#87

Post by lawn »

trallnag wrote: post #76
arp242 wrote: post #42

Earlier quoted context omitted.

That Canonical guy is not coming off brilliantly there. I appreciate that reasonable people can disagree on the best way to package this, but these kind of strong absolute statements – together with calling useful features "misguided" and "crap" – is not great, to put it mildly. I'm pretty sure some compromise could theoretically be reached here. But not with that attitude. "It is our responsibility to our users to p…

What's the alternative to Debian / Ubuntu now that CentOS is gone?

Arch Linux and Void Linux are both worth a look I'd say.

Re: KeePassXC Debian maintainer has removed all network features

#89

Post by ATMLOTTOBEER »

okl wrote: post #4
HieronymusBosch wrote: post #3

For folks interested this issue on GitHub seems to have the latest comments. https://github.com/keepassxreboot/keepassxc/issues/10725

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…

I laughed when I saw this. I once tried to be a hit and run contributor to a project he maintains and I found him to be rude. He is still at it it seems.

Re: KeePassXC Debian maintainer has removed all network features

#90

Post by worble »

theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

> calling your upstream "crappy"[0] is probably not the most productive way for package maintainer to act

This is so incredibly rude to post on the github it'd make me reconsider using Debian at all if I did. If the package is so full of "crappy" features why is he even bothering to maintain it? Just get rid of it and let users figure out how to install it properly themselves.

I feel bad for KeepassXC devs, maintaining an open source project is hard enough without having to deal with crap like this.

Post reply on HN