A password manager without browser integration is essentially dead in the water. Seems like what they're shipping is unusable for most people. We all know 'unusable FOSS' cliché but in this case it actually applies.
KeePassXC Debian maintainer has removed all network features
251–260 of 367 posts
Re: KeePassXC Debian maintainer has removed all network features
#252Earlier quoted context omitted.
I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…
I share your frustration because comments like that show up in every thread about open source. By putting something out into the world you're creating connections with others. If people like what you've built and start to rely on it then that puts power into your hands, and any time you have power over others it should be wielded responsibly. Volunteering doesn't give people a pass to screw over others.
And who decides "responsible"? The mantainer made the decision of defaulting to no-network for safety reasons, that users can reverse with a flag. This sounds responsible enough for me.
I bet that if a bug is found in the connection API and passwords leak, we would impale the head of the mantainer in a pike for not defaulting to safe mode, or to have connection at all.
Re: KeePassXC Debian maintainer has removed all network features
#253I abandoned KeePassX (pre XC fork) when they made wonky changes ~10 years ago. Use Bitwarden (optionally run your own sync server) or Keeper (for less technical people).
I recently switched from BW to XC in the wake of their acquisition, and I have to admit, the mobile experience is just a little more annoying. But I sleep better at night knowing that I don't keep anything critical on servers I don't own.
1. What acquisition? https://bitwarden.com/blog/
2. You can run your own FOSS Bitwarden sync server. It even works airgapped.
Re: KeePassXC Debian maintainer has removed all network features
#254It's crazy the amount of power maintainers hold over someone else's software. This reminds me of the time when Fedora maintainers disabled GLES1 support in Mesa because "nobody should be using it anymore (there are newer OpenGL versions)", disregarding the fact that GLES1 was well and fully maintained upstream, and was and is still the only option on many devices.
Re: KeePassXC Debian maintainer has removed all network features
#255Hissy-fits like these are one of the reasons there's never going to be a "year of the linux on desktop"
But why do they care, right? Most people on their irc channel (that have a basement NAS may I add) agree with their decision.
Now my bet is that your average Debian user does care about convenience. Replacing (default off) selection boxes with different sw packages is acceptable in only a minority of cases, and doesn't seem to be the case here.
Re: KeePassXC Debian maintainer has removed all network features
#256We used to deploy on Debian at my previous place, and we hit this sort of shit all the time. Maintainer ripped out features they disagreed with (political reasons, or just engineering/product taste), maintainers changing the configuration files to things that suited them better, etc.
I understand it's all volunteer work, I understand it's open source so anyone can add their own custom packaging, on top, but Debian (the OS) certainly uses the ecosystem as a selling point, and it really can come back to bite you.
Re: KeePassXC Debian maintainer has removed all network features
#257It's crazy the amount of power maintainers hold over someone else's software. This reminds me of the time when Fedora maintainers disabled GLES1 support in Mesa because "nobody should be using it anymore (there are newer OpenGL versions)", disregarding the fact that GLES1 was well and fully maintained upstream, and was and is still the only option on many devices.
>power maintainers hold over someone else's software
There's some subtle assumptions about ownership in this comment that aren't accurate, insofar as free and open source software is concerned.
FOSS software is not "someone else's" software. They may own the trade mark, but by releasing the software under a FOSS licence, they lose the right to control the direction the software may take. I'm free to copy it, edit it, and redistribute it as I see fit. So are you. So is Debian.
Re: KeePassXC Debian maintainer has removed all network features
#258I think it's correct for the default package to be the safest-possible one. It's a password manager not an mp3 player. Yes it's annoying that an existing behavior will change, but that problem is not more impportant than the problem of what should be the default behavior of a security app. keepassxc should have always been like that by default and all the added conveniences that also add bug-surface and attack-surfac…
Debian is somewhat inconsistent with this but it does have precedent for package to be package-minimal and a corresponding full- variant. Odd to just break users by doing this, should have been done with a major release when people expect breakage.
Uh, it's only changed in unstable, so it will be a major release when current testing is released.
Re: KeePassXC Debian maintainer has removed all network features
#259Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…
> Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best
reminds me of busybox's implementations of: bash, sed, awk, ect and similar situations when folks go and ask 'how something-in bash works' then 'it doesnt work' all because of macos bash vs gnu bash, and forever on the battle goes with naming.
Re: KeePassXC Debian maintainer has removed all network features
#260Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…
All they did was change the XC_ALL build parameter to OFF [0] which happens to be the default in upstream's CMakeLists.txt [1]. If upstream thinks this functionality is so important maybe they should fix their defaults. I think it's a bit unfortunate that users of this package may be confused why stuff stops working when they upgrade, but having the unsuffixed package match upstream defaults seems entirely reasonable…
At first I thought it should be the other way around. Keep the current keepassxc package and create a keepassxc-minimal. But seeing the build options it makes sense to have a keepassxc-full.
Only thing is this will annoy some people when they upgrade. But only when this reaches stable and then there will be notice in the upgrade documentation and apt-listchangea.