Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

281–290 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#281

Post by dabacaba »

VonGallifrey wrote: post #230
dabacaba wrote: post #164

Earlier quoted context omitted.

Usually SSO means that you have to login just once to access all of your accounts. If it requires you to login multiple times a day then something is not configured correctly.

Well... at my current employer, we have 3 "SSO" providers. By that, I mean three different Okta logins, and logging in to any of them will log you out of the other two. If I want to do anything, it means I need to log in again because it is unlikely that I am logged in to the right account. Yes, I need all 3 multiple times daily. There is no logic about which one I need for which system. IT knows this is not how it i…

If you can use Firefox, it allows you to create multiple "containers", each with its own set of cookies and other state. You can create a separate container for each Okta login, then you can be logged into all three accounts simultaneously.

Also you can create a separate browser profile for each account. This works with all browsers but is less convenient, because it forces you to have a separate browser window for each profile, and also you need to enter all preferences for each profile separately.

Re: KeePassXC Debian maintainer has removed all network features

#282

Post by kasabali »

LightFog wrote: post #280
kasabali wrote: post #275

Earlier quoted context omitted.

> user-hostile manner This isn't user hostile. You know what'd be user hostile? Removing the functionality and not providing the -full package alongside.

It is. The software has been broken - the UI wasn’t designed with those toggles in mind so now users suddenly have non functioning features presented to the in the UI. The argument the all users should be keeping up to speed on NEWS - especially in the stable channels this will end up in - to explain why their UX is suddenly broken is not exactly ‘user friendly’.

> all users should be keeping up to speed on NEWS

They don't need to, it is shown to them during apt-get upgrade

> especially in the stable channels

This is in testing/unstable. Stable users aren't and won't be affected until until the next major Debian version is released and the users decides to do the upgrade.

Re: KeePassXC Debian maintainer has removed all network features

#284

Post by nrabulinski »

roenxi wrote: post #224
Dalewyn wrote: post #216

Earlier quoted context omitted.

>And some reasonable expectations of respect. Volunteers by definition do not (or at least should not) expect anything in return for their time. If you want respect as a so-called volunteer, you're not a volunteer. I've seen both good and bad package maintainers, too.

> Volunteers by definition do not (or at least should not) expect anything in return for their time That isn't really true. For starters, paid volunteers are actually a thing that happens from time to time. Secondly; there would be no volunteers if they didn't get something for their time. It is just generally that something isn't money. Volunteers aren't expected to be selfless.

If you’re getting paid you’re by definition not a volunteer. You may be getting some perks like volunteering at a convention giving you an entry pass for that convention, but as soon as you’re getting some other gains, be it monetary or not, you’re no longer a volunteer.

Re: KeePassXC Debian maintainer has removed all network features

#285

Post by nrabulinski »

otherme123 wrote: post #252
CooCooCaCha wrote: post #189

Earlier quoted context omitted.

I share your frustration because comments like that show up in every thread about open source. By putting something out into the world you're creating connections with others. If people like what you've built and start to rely on it then that puts power into your hands, and any time you have power over others it should be wielded responsibly. Volunteering doesn't give people a pass to screw over others.

And who decides "responsible"? The mantainer made the decision of defaulting to no-network for safety reasons, that users can reverse with a flag. This sounds responsible enough for me. I bet that if a bug is found in the connection API and passwords leak, we would impale the head of the mantainer in a pike for not defaulting to safe mode, or to have connection at all.

And the software authors made it clear that those features, even if compiled in, are disabled by default and the code never executes.

Re: KeePassXC Debian maintainer has removed all network features

#286

Post by pquki4 »

NikkiA wrote: post #217
worble wrote: post #90

Earlier quoted context omitted.

> calling your upstream "crappy"[0] is probably not the most productive way for package maintainer to act This is so incredibly rude to post on the github it'd make me reconsider using Debian at all if I did. If the package is so full of "crappy" features why is he even bothering to maintain it? Just get rid of it and let users figure out how to install it properly themselves. I feel bad for KeepassXC devs, maintaini…

TBF he's a canonical employee, not a debian employee, he's paid to maintain Ubuntu packages, but volunteers for the debian ones, so I'd be more side-eyeing Ubuntu first. But then I gave up on debian a while ago because of some of their more questionable decisions.

Interesting, what are some examples of questionable decisions?

Re: KeePassXC Debian maintainer has removed all network features

#287

Post by roenxi »

nrabulinski wrote: post #284
roenxi wrote: post #224

Earlier quoted context omitted.

> Volunteers by definition do not (or at least should not) expect anything in return for their time That isn't really true. For starters, paid volunteers are actually a thing that happens from time to time. Secondly; there would be no volunteers if they didn't get something for their time. It is just generally that something isn't money. Volunteers aren't expected to be selfless.

If you’re getting paid you’re by definition not a volunteer. You may be getting some perks like volunteering at a convention giving you an entry pass for that convention, but as soon as you’re getting some other gains, be it monetary or not, you’re no longer a volunteer.

> If you’re getting paid you’re by definition not a volunteer.

You are technically incorrect. The US army, for example, is manned more or less entirely with paid volunteers.

And while many volunteers may not get formal compensation, they have to expect to get something out of the experience. Otherwise they would not do it. The subset of volunteers who are in it purely for a biblically pure sense of charity is tiny. And there is no expectation that Debian developers are motivated by some cultish wish to do good for the sake of free software. They're allowed to be motivated by whatever motivates them to do good with free software. Even if it is money.

Re: KeePassXC Debian maintainer has removed all network features

#288

Post by jdbernard »

kiwijamo wrote: post #250
jdbernard wrote: post #150

Earlier quoted context omitted.

Particularly of features that users depend on. It really leaves the impression that he thinks very little of debian users.

Features that according to your GP was disabled by default. And according to others in this discussion thread, disabled by default in the upstream also.

If you read the GitHub discussion these features are usually compiled in but not actually exercised until the user enabled then in the UI. The debian packager has changed the compile-time configuration to disable them at compile-time, making them unavailable to the user in the UI. Regardless of the makefile defaults this be a breaking change.

There is a some confusion because the flags that control these features at compile-time do default to OFF if not provided, but the installation instructions in the same documentation also tell you to compile with XC_ALL set to ON. The maintainers themselves talk about all features being enabled at compile-time in the discussion thread and even consider removing these compile-time flags altogether to prevent compiling keepassxc without these features. So "disabled by default" is not really an accurate understanding. It is clear that the intended configuration from the authors is for all features to be compiled in and available.

See: https://github.com/keepassxreboot/keepassxc/issues/10725#iss... https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

Re: KeePassXC Debian maintainer has removed all network features

#289

Post by guilhas »

lawn wrote: post #138

From a KeePassXC maintainer: > In the lead up to this thread I received three reports of this new package method crippling people's workflow. One report was a user who couldn't open their database anymore because the yubikey feature was removed. Let that sink in for a second. People who lose access to their most important secrets can sometimes do irrational things in the moment of panic. https://github.com/keepassxre…

Everyone using an offline password manager without having a backup might as well consider everything lost

This sounds like emotional blackmail

How many times I lost everything, hardware failure, updates that broke OS, using dd in the wrong drive...

Re: KeePassXC Debian maintainer has removed all network features

#290

Post by phoerious »

kragen wrote: post #192
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

lots of debian packages are compiled without some compile flags that enable optional functionality; emacs, for example, comes in emacs-nox, emacs-gtk, and emacs-lucid, the last two of which use two different x-windows toolkits to give emacs a gui. (it's nice to not have to install a gui environment in order to have a text editor, see.) vim similarly has vim-tiny, vim-nox, vim-motif, and vim-gtk3 versions in this case…

The extra functionality isn't opening security holes. It is central functionality that users have come to expect such as Auto-Type or support for YubiKeys. The Debian maintainer has decided to disable the WITH_XC_ALL flag, which disables ALL optional features (not sure why you consider this a lie).

Your claim that KeePassXC communicates with random webpages is also false. There are two cases in which websites are communicated with (none of them random): a) an optional update check (can be disabled), b) when you click the button to download a website's favicon. Please don't just state things that are not true.

Post reply on HN