Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

261–270 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#261

Post by moqmar »

kragen wrote: post #192
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

lots of debian packages are compiled without some compile flags that enable optional functionality; emacs, for example, comes in emacs-nox, emacs-gtk, and emacs-lucid, the last two of which use two different x-windows toolkits to give emacs a gui. (it's nice to not have to install a gui environment in order to have a text editor, see.) vim similarly has vim-tiny, vim-nox, vim-motif, and vim-gtk3 versions in this case…

So the Debian maintainer complains about the upstream project (which they decided to maintain the package for) bringing "crap" and having "utterly misguided" development? And somehow people say that this is the reasonable person here, basing a major change of a software's featureset on such an opinion?

Independent from whether the original change is good or bad, so much of what's wrong with Open Source is people trying to work against each other instead of together...

Re: KeePassXC Debian maintainer has removed all network features

#262

Post by skjoldr »

kiwijamo wrote: post #249
charles_f wrote: post #33

Earlier quoted context omitted.

He removed not only networking but support for yubikey, and autotype. These are all features that are turned off by default.

If it's turned off by default, then please explain the drama. This simple statement makes this drama look like a storm in the proverbial teacup.

If I have both enabled in my install, which I specifically chose to, then upgrading the package locks me out of my database, because those features are not compiled.

Re: KeePassXC Debian maintainer has removed all network features

#264

Post by kasabali »

thaumaturgy wrote: post #86
cjk2 wrote: post #72

Earlier quoted context omitted.

I think you'd have to actually ask the users about that. Not make assumptions based on some loud people on a Mastodon thread. What the user is given here is a choice.

Users should be asked if they actually wanted the features in the existing package after all? Why shouldn't users have been asked before changing the existing package? I'm one of those users. If I'm loud, does that mean my opinion doesn't count anymore?

> Why shouldn't users have been asked before changing the existing package?

They were. apt shows the NEWS file during update when there's a change.

Re: KeePassXC Debian maintainer has removed all network features

#265

Post by kasabali »

petee wrote: post #107
cjk2 wrote: post #100

Earlier quoted context omitted.

Hyperbole! $ apt install keepassx $ apt install keepassx-full Choice made.

Choice was already made when they installed it with xyz features available. If it was so important they never should have packaged it in the first place. -Minimal option is the obvious reasonable choice, unless trying to be an arse to make a point, since you're changing a users choice after the fact. Are we going to stop compiling sshd with plaintext pw options and root login, and suddenly? If a user has an option en…

> If a user has an option enabled you don't like anymore, notify them, don't blindly remove functionality and say "your fault for not reading the changelogs".

apt shows the NEWS file during update when there's a change. These users not only have chosen to actively ignore the warning that has been shown to them by default, they've also chosen to directly go to upstream to complain instead of first their distributions channels.

Re: KeePassXC Debian maintainer has removed all network features

#266

Post by kragen »

moqmar wrote: post #261
kragen wrote: post #192

Earlier quoted context omitted.

lots of debian packages are compiled without some compile flags that enable optional functionality; emacs, for example, comes in emacs-nox, emacs-gtk, and emacs-lucid, the last two of which use two different x-windows toolkits to give emacs a gui. (it's nice to not have to install a gui environment in order to have a text editor, see.) vim similarly has vim-tiny, vim-nox, vim-motif, and vim-gtk3 versions in this case…

So the Debian maintainer complains about the upstream project (which they decided to maintain the package for) bringing "crap" and having "utterly misguided" development? And somehow people say that this is the reasonable person here, basing a major change of a software's featureset on such an opinion? Independent from whether the original change is good or bad, so much of what's wrong with Open Source is people tryi…

what leads you to suspect he's wrong? from the quotes in your comment i suspect it's his choice to use plain language and openly disagree with others. in my experience that's how trustworthy, competent people talk

people working together successfully in free software doesn't depend on them having the same values or getting along or wanting the software to do the same thing. it just depends on being clear and open about what the software does and doesn't do, and using licenses that keep them from suing you for distributing versions without their preferred features or antifeatures. remember that this is the movement that not only includes richard stallman but was founded by him. if it depended on getting along it never would have left the cradle

Re: KeePassXC Debian maintainer has removed all network features

#267

Post by kasabali »

skjoldr wrote: post #262
kiwijamo wrote: post #249

Earlier quoted context omitted.

If it's turned off by default, then please explain the drama. This simple statement makes this drama look like a storm in the proverbial teacup.

If I have both enabled in my install, which I specifically chose to, then upgrading the package locks me out of my database, because those features are not compiled.

Jeez, then you simply install the keepassxc-full package and move on. It's not like you store your sudo password in keepass database, too.

Re: KeePassXC Debian maintainer has removed all network features

#268

Post by kasabali »

strken wrote: post #186
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

I agree that network features and browser integrations are huge potential holes, but the contributors on the GitHub issue make a very good point when they say that there's minimal testing of the stripped-down build in comparison with the full build, and no testing at all of random combinations of build flags. As noted elsewhere, one of the "optional" flags that got disabled is yubikey support, without which users are…

> make a very good point when they say that there's minimal testing of the stripped-down build in comparison with the full build,

So they should be thankful their software will have better test coverage thanks to Debian users

Re: KeePassXC Debian maintainer has removed all network features

#269

Post by kasabali »

fallingsquirrel wrote: post #23
donio wrote: post #8

Earlier quoted context omitted.

The WITH_XC_NETWORKING build option is off by default so the developers have obviously intended this to be a valid build configuration.

Sure, but that doesn't change the fact that a point release suddenly broke everyone's workflows and is causing maintenance headaches. I don't think the technical minutia of how exactly things were broken is the issue. If Debian shipped a Linux kernel point release that disabled networking I think people would be similarly upset, even though it's also just a build option and intended to be a valid build configuration…

> that doesn't change the fact that a point release suddenly broke everyone's workflows

BS. This change was in Debian sid/testing. That's what it's for. Debian stable users' workflow hasn't been broken.

Re: KeePassXC Debian maintainer has removed all network features

#270

Post by kasabali »

paulryanrogers wrote: post #225
Arnavion wrote: post #141

Earlier quoted context omitted.

You don't have to proactively read it. But when you notice your keepassxc doesn't work as it used to before, that should be a trigger for you to go back and read it, note that it tells you very clearly that the functionality you're missing is now in keepassxc-full, apt-install it, and go on with your life.

One doesn't expect such a drastic ... 'fix' in a point release though.

You're talking as if it's a point release of Debian. It is not. It happened in sid/testing, that's what these releases are for.

Whether it happened in a point or major release of Keepassxc is irrelevant, because ignorant users who upgrade their sid/testing installations blindly as if it was stable-security would have hit it eventually.

Post reply on HN