Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

181–190 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#181

Post by jeffalyanak »

rfoo wrote: post #57
jeffalyanak wrote: post #46

I think the solution suggested by drawks seems clearly the correct choice: > I think the proper solution would probably be to package both a "-full" and "-minimal" version of the software and utilize Debian package meta-data fields to define a Conflicts relationship between the packages and tag them also both with a Provides for keepassxc and also add a tag Replaces: keepassxc to the -full build so that during a pack…

Because maintainers have an opinion and explicitly wanted to change the default.

That does allow you to change the default for users installing the packages and while ensuring that users who already have it installed don't lose functionality during an upgrade.

Re: KeePassXC Debian maintainer has removed all network features

#182

Post by NewJazz »

TehCorwiz wrote: post #145
Dah00n wrote: post #51

Earlier quoted context omitted.

They didn't "gut what upstream built". He published it without plugins and made a -full version that include plugins. If plugins are plugged in as default it isn't a plugin but a built-in feature. This is the correct way.

They're not "plugins". They're compiled in features. The Debian maintainer changed one compile flag and turned off these feature which are disabled by default in the UI anyway. And changing the compile flag didn't remove the options that enable the features from the UI. So, users are very confused why the features they're trying to use don't work. Further, what happens to existing users who had these features enabled…

Isn't this something that Debian can do during upgrades, though?

Like sure there is breakage, if you don't read the news before upgrading major versions.

Re: KeePassXC Debian maintainer has removed all network features

#183

Post by BLKNSLVR »

alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Isn't this just FOSS working as intended?

There are lots of distributions other than Debian.

Re: KeePassXC Debian maintainer has removed all network features

#184

Post by shmerl »

There was some comment about it. Basically, it's for security reasons. Those who aren't using those features wouldn't expect them to appear (especially sneakily). And those who are planning to use them will figure out what package to install.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529

This was the message from maintainers:

    Networking and all plugins have been moved into
    the keepassxc-full package.

    Feature creep like SSH agent support, browser
    integration, Freedesktop.org secret storage,
    KeeShare pose undue risks for most users.

Re: KeePassXC Debian maintainer has removed all network features

#185

Post by [deleted] »

BLKNSLVR wrote: post #183
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Isn't this just FOSS working as intended? There are lots of distributions other than Debian.

[deleted]

Re: KeePassXC Debian maintainer has removed all network features

#186

Post by strken »

theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

I agree that network features and browser integrations are huge potential holes, but the contributors on the GitHub issue make a very good point when they say that there's minimal testing of the stripped-down build in comparison with the full build, and no testing at all of random combinations of build flags.

As noted elsewhere, one of the "optional" flags that got disabled is yubikey support, without which users are getting locked out of their password manager when they upgrade to the new, broken package. Enabling just that flag puts the project in a state which nobody is actually testing.

I agree that calling the package keepassxc-lite would have prevented this issue, assuming existing users were moved to keepassxc-full, but that's the entire problem here! It's a reasonable choice to default to the most secure solution (not that hypothetical attack surface is a real vulnerability), but as a maintainer you shouldn't break existing functionality unless either upstream or your users want you to, and you particularly shouldn't lock users out of their password manager.

Re: KeePassXC Debian maintainer has removed all network features

#187

Post by mikl »

theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

Whether his changes are good or not, it’s still pretty crazy to essentially fork an open source project, but publish your very different version under the same name.

Re: KeePassXC Debian maintainer has removed all network features

#188

Post by 1oooqooq »

DDiggler wrote: post #134

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3]. Absolutely insan…

why fish for fwupd? systemd-resolved which is everywhere, will open (at request) an LLMNR server (a.k.a. mDNS, nee microsoft netbios) on port 5355.

With IoT everyone have access to your LAN, so now people are making sure linux also join the REDACTED party

btw, fix for fwupmdg, since they have a low quality default conf file without commented out defaults:

   ```
   # /etc/fwupd/fwupd.conf
   [fwupd]
   P2pPolicy=none
   ```
fix for resolved is commented out on /etc/systemd/resolved.conf `LLMNR=no`, and you probably also want `DNSStubListener=no`. heck here is a good default

   ```
   # /etc/systemd/resolved.conf
   [Resolve]
   DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
   FallbackDNS=127.0.0.1 ::1
   Domains=~.
   DNSOverTLS=yes
   LLMNR=no
   DNSStubListener=no
   ```

Re: KeePassXC Debian maintainer has removed all network features

#189

Post by CooCooCaCha »

thaumaturgy wrote: post #111
barbariangrunge wrote: post #92

Earlier quoted context omitted.

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…

I share your frustration because comments like that show up in every thread about open source.

By putting something out into the world you're creating connections with others. If people like what you've built and start to rely on it then that puts power into your hands, and any time you have power over others it should be wielded responsibly.

Volunteering doesn't give people a pass to screw over others.

Re: KeePassXC Debian maintainer has removed all network features

#190

Post by password4321 »

TehCorwiz wrote: post #145
Dah00n wrote: post #51

Earlier quoted context omitted.

They didn't "gut what upstream built". He published it without plugins and made a -full version that include plugins. If plugins are plugged in as default it isn't a plugin but a built-in feature. This is the correct way.

They're not "plugins". They're compiled in features. The Debian maintainer changed one compile flag and turned off these feature which are disabled by default in the UI anyway. And changing the compile flag didn't remove the options that enable the features from the UI. So, users are very confused why the features they're trying to use don't work. Further, what happens to existing users who had these features enabled…

> changing the compile flag didn't remove the options that enable the features from the UI

Hopefully this will get fixed

Post reply on HN