Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

231–240 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#231

Post by valicord »

roenxi wrote: post #209
thaumaturgy wrote: post #111

Earlier quoted context omitted.

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding. > Package maintainers aren't self-sacrificial saints or all that unique as volunteers go. If you want keepassx, you can go install it. If you want the Debian a…

> And some reasonable expectations of respect.

I think that expectation ends once you start calling the other party's software "crappy".

Re: KeePassXC Debian maintainer has removed all network features

#232

Post by abdullahkhalids »

NikkiA wrote: post #193
abdullahkhalids wrote: post #77

Earlier quoted context omitted.

Can someone make a security related case for disabling autotype?

"If hit by mistake it might autotype in a window that is not at a login prompt, but maybe on a chat session and broadcast the user's password" It's horseshit, but it's an argument lets see what it does here... NikkiA edit: well, I guess it didn't broadcast the password, but it probably would have done on a real chat window that accepted multiple lines of input

That's actually reasonable. I use keepassxc, and I have messed the autotype many times. But I mean, that is not an argument for disabling the feature.

Re: KeePassXC Debian maintainer has removed all network features

#233

Post by naniwaduni »

joeyh wrote: post #165
yjftsjthsd-h wrote: post #123

Earlier quoted context omitted.

But vim-nox is a separate package with a clear name saying that it's got X removed; I don't think this would be nearly as controversial if they'd shipped a keepassxc-nonetwork package.

vim-tiny is installed by default on debian (providing a vim command), and also has X removed.

Yeah, I hated that too.

Re: KeePassXC Debian maintainer has removed all network features

#234

Post by bdd8f1df777b »

theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

I see this kind of mindset often--if we remove the features useful but not perfectly secure from users, we can protect them from such insecurity. But this mindset is wrong. What happens instead is that users will fulfill their needs in even more insecure ways.

Re: KeePassXC Debian maintainer has removed all network features

#235

Post by mikepavone »

alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

All they did was change the XC_ALL build parameter to OFF [0] which happens to be the default in upstream's CMakeLists.txt [1]. If upstream thinks this functionality is so important maybe they should fix their defaults.

I think it's a bit unfortunate that users of this package may be confused why stuff stops working when they upgrade, but having the unsuffixed package match upstream defaults seems entirely reasonable otherwise.

[0] https://salsa.debian.org/debian/keepassxc/-/commit/7d6d16e3f... [1] https://github.com/keepassxreboot/keepassxc/blob/develop/CMa...

Re: KeePassXC Debian maintainer has removed all network features

#236

Post by rendaw »

NikkiA wrote: post #193
abdullahkhalids wrote: post #77

Earlier quoted context omitted.

Can someone make a security related case for disabling autotype?

"If hit by mistake it might autotype in a window that is not at a login prompt, but maybe on a chat session and broadcast the user's password" It's horseshit, but it's an argument lets see what it does here... NikkiA edit: well, I guess it didn't broadcast the password, but it probably would have done on a real chat window that accepted multiple lines of input

I'd assume it would only put the password in a type="password" input, not a random text box.

Re: KeePassXC Debian maintainer has removed all network features

#237

Post by kiwijamo »

techwizrd wrote: post #214
roenxi wrote: post #209

Earlier quoted context omitted.

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding. > Package maintainers aren't self-sacrificial saints or all that unique as volunteers go. If you want keepassx, you can go install it. If you want the Debian a…

Is it a _fundamentally_ bad idea? The connected syncing feature of Bitwarden is one of my favorite things. I can save a password on one device, and its automagically available on others all while staying encrypted (and audited).

Agreed but it is worth keeping in mind that Bitwarden's implementation of sync is probably a lot more sophisticated than KeepassXC; and is probably the main reason why one would use Bitwarden. I am a former user of Keepass and I never knew it had network functionality so I think it makes sense to provide two packages -- one containing the main keepass functions which which 99% of users will use and the othrer for the 1% using the exotic functions. This is in line with how Debian handles many other packages such as vim, exim, etc so it is not at all surprising for the typical Debian user.

Re: KeePassXC Debian maintainer has removed all network features

#238

Post by kiwijamo »

Kwpolska wrote: post #144
whoopdedo wrote: post #139

Earlier quoted context omitted.

The feature flag is put there by upstream. If they don't want to support non-network installs then why do they even have that lever? That said it probably makes more sense for Debian to package a `keepassxc-nonet` alongside the default `keepassxc` so end users can choose the variant.

If a user wants to build a hardened copy, they are free to do that. Distros should provide a version with standard features that are expected by end users.

As a Debian user I like how Debian just includes the basics in the main package and provides optional extras if you want them. I'm not sure how other distros handle it the other way around -- if the main package includes everything the risk is naive users install packages that include functions they don't need that end up exposing security issues. The Debian approach provides a reduced attack surface out of the box and if I happen to need something more its easy to just apt search ${package_name} and see what other extensions are available and install these. I do this regularly for PHP modules for instance if some PHP code complains a certain module is not available. It may not be your cup of tea but this is the Debian approach, and it makes sense from the perspective of a defensive user like me to keep things simple.

Re: KeePassXC Debian maintainer has removed all network features

#239

Post by kiwijamo »

netsharc wrote: post #197
Kwpolska wrote: post #144

Earlier quoted context omitted.

If a user wants to build a hardened copy, they are free to do that. Distros should provide a version with standard features that are expected by end users.

I agree, it's also supremely obnoxious that upgrading a piece of software means losing a lot of functionality - unless the user knows s/he needs to replace the package with the -full version.. Wahey, isn't that what MS does with e.g. Outlook. Congrats Debian, you're reaching Microsoft's level!

I agree that is unfortunate however I would argue the package should have been built that way in the first place. It's not the best thing to do now but better late than never. I wonder if the Debian maintainer would consider some sort of transactional package which brings in the new package if you had the original one installed. However, as someone who has used Keepass and did not realise it had all these extra functionalities, I think the assessment that most users will see no difference is ultimately closer to the truth than many people realise. I migrated away from Keepass specifically because I thought it had no network functions which makes all this drama especially ironic for a software that was marketed (at the time) as a password manager to keep on your own device and not someone else's machine.
Post reply on HN