Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

201–210 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#201

Post by valicord »

barbariangrunge wrote: post #92
thaumaturgy wrote: post #62

Earlier quoted context omitted.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

If you claim to distribute application FooBar, you owe it to the authors of said application to actually distribute FooBar and not something else that was modified against their wishes. If you want to distribute a modified version, you should call it something other than FooBar.

You also owe it to your users to not mislead them by claiming that your modified version is actually the real FooBar.

Re: KeePassXC Debian maintainer has removed all network features

#202

Post by kragen »

netsharc wrote: post #199
kragen wrote: post #192

Earlier quoted context omitted.

lots of debian packages are compiled without some compile flags that enable optional functionality; emacs, for example, comes in emacs-nox, emacs-gtk, and emacs-lucid, the last two of which use two different x-windows toolkits to give emacs a gui. (it's nice to not have to install a gui environment in order to have a text editor, see.) vim similarly has vim-tiny, vim-nox, vim-motif, and vim-gtk3 versions in this case…

Your points are valid, but doing a switcheroo of someone's software is the stupid part... You say you trust Debian, but until this update, they've been allowing those horrible horrible shenanigans, on your system! Would you trust a security guard who for many years didn't notice a part of the building he should've checked for unlocked doors, until someone pointed it out to him?

it's a question of degree. i'd trust him more if he'd been checking it all along, but i'd trust him less if he decided that he shouldn't start checking it even after it was pointed out

debian has made much worse security mistakes than that; i personally danced tango at debconf with the debian maintainer who introduced the openssl bug, which is arguably the worst computer security hole in human history

basically the social practices of software development make computer security unattainable at any cost. we can try to improve that situation, but for the time being, debian is close to the best there is, even if it's not openbsd or sel4

Re: KeePassXC Debian maintainer has removed all network features

#204

Post by Dylan16807 »

bananapub wrote: post #17
JohnTHaller wrote: post #12

Earlier quoted context omitted.

The default package should be named keepassxc-debian-limited or similar and the proper package should be keepassxc

OK? that has nothing to do with what I was correcting: > IMHO is a downstream maintainer is going to change a package in a way that doesn't have the intent of the upstream project, it should be published under a different name and that maintainer deal with all bug reports caused by their modified version. the downstream maintainer didn't "change a package in a way that doesn't have the intent of the upstream project"…

> the downstream maintainer didn't "change a package in a way that doesn't have the intent of the upstream project", they altered the config flags in one package and made another with the previous flags.

They altered the config flags in a way that doesn't have the intent of the upstream project. And I would classify build config changes as a subset of "changing a package".

Re: KeePassXC Debian maintainer has removed all network features

#205

Post by 1oooqooq »

workethics wrote: post #163
DDiggler wrote: post #134

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3]. Absolutely insan…

Good to know. I think this should probably be it's own post

https://news.ycombinator.com/item?id=40322408

Re: KeePassXC Debian maintainer has removed all network features

#206

Post by Dylan16807 »

shmerl wrote: post #184

There was some comment about it. Basically, it's for security reasons. Those who aren't using those features wouldn't expect them to appear (especially sneakily). And those who are planning to use them will figure out what package to install. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529 This was the message from maintainers: Networking and all plugins have been moved into the keepassxc-full package. Featu…

Browser integration and autotype are not feature creep.

Making everything copy-paste is bad for security.

Re: KeePassXC Debian maintainer has removed all network features

#207

Post by Dylan16807 »

Brian_K_White wrote: post #94
timw4mail wrote: post #75

Earlier quoted context omitted.

Absolute security means you can't do anything . Too much security friction can easily lead to *much more insecure* workarounds.

Somehow, I have been using the same app without any of those features. So, the idea that the app is not functional or useful without them is bullshit. As for friction leading indirectly to less security through user behavior... how many clicks and how many seconds is it to install the full version? So, yet more bullshit.

> Somehow, I have been using the same app without any of those features.

And are you putting your passwords on the clipboard in a way that doesn't verify domain names?

Congratulations, you're using insecure methods. Not bullshit.

Re: KeePassXC Debian maintainer has removed all network features

#208

Post by jeroenhd »

Brian_K_White wrote: post #69
brnt wrote: post #24

Earlier quoted context omitted.

They disabled all plugins, not just those that may access networks. This is not good, it's nonsensical.

Thinking browser or other local integration is not as dangerous as network features is nonsensical. All of the disabled features are expendable. I never used any even while they were in there. Yet I do use keepassxc all day every day for the one job it actually does exist to do. Convenience and necessity are two different things. You want conveninece, and you're not wrong to want it, but you don't need it, and your w…

Browser integration, if done well, is actually more secure than the copy+pasting you end up doing otherwise. Storing passwords in the clipboard is a massive security risk, as the clipboard is shared by all applications and websites, while direct browser integrations allow for only providing the credentials to the specific web page they're meant for.

While I'm not opposed to differentiating between a -full and a -minimal version, calling every plugin dangerous by default doesn't make sense.

Re: KeePassXC Debian maintainer has removed all network features

#209

Post by roenxi »

thaumaturgy wrote: post #111
barbariangrunge wrote: post #92

Earlier quoted context omitted.

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding.

> Package maintainers aren't self-sacrificial saints or all that unique as volunteers go.

If you want keepassx, you can go install it. If you want the Debian archive's version, install that. All the options are open to critique, but the average Debian maintainer is doing so much more good than the occasional bad decision that they get a lot of benefit-of-doubt on this sort of choice. And some reasonable expectations of respect.

Re: KeePassXC Debian maintainer has removed all network features

#210

Post by [deleted] »

Arnavion wrote: post #179
accoil wrote: post #168

Earlier quoted context omitted.

It's not like the clipboard is secure either. Any arbitrary app can listen to the clipboard in X11, and while it seems harder in Wayland, I'm not sure if I've ever seen a clipboard permission dialog (my Wayland experience is limited though). Turning off the browser intergation means that the user may accidentally auto-type into the wrong website. Turning off auto-type means that external applications can see the pass…

With Wayland, the compositor gets to decide which clients to send the "clipboard data available to paste from this file descriptor" event to (wl_data_offer). For example the compositor might only send it to the client whose window is currently focused. So clients that don't receive this event would not have the fd to be able to read from it. Clients that do receive the event can read that data without any restriction…

[deleted]
Post reply on HN