Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

301–310 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#301

Post by vilunov »

dannyw wrote: post #52
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

The role of a maintainer is more than copying and pasting upstream. They are allowed to exercise their judgement in what they believe is appropriate for end users of a distribution. In this case, there does seem to be reasonable security justifications for it, and an alternative is provided.

I don't understand the need of such a role at all. It's fine if it's the OS-level software, but for end-user applications such as KeePass I'd prefer that there would be no intermediaries between the developers of the app and the users. You don't need to repackage every piece of software that your users might want to use, let developers target your OS on their own by providing a stable set of APIs and ABIs, otherwise it's not really an OS.

Re: KeePassXC Debian maintainer has removed all network features

#302

Post by charles_f »

rendaw wrote: post #236
NikkiA wrote: post #193

Earlier quoted context omitted.

"If hit by mistake it might autotype in a window that is not at a login prompt, but maybe on a chat session and broadcast the user's password" It's horseshit, but it's an argument lets see what it does here... NikkiA edit: well, I guess it didn't broadcast the password, but it probably would have done on a real chat window that accepted multiple lines of input

I'd assume it would only put the password in a type="password" input, not a random text box.

No, autotype does what it says, it simulates typing keys without looking at the screen

Re: KeePassXC Debian maintainer has removed all network features

#303

Post by 1oooqooq »

rationably wrote: post #297
1oooqooq wrote: post #294

Earlier quoted context omitted.

Because the history is not linear. See https://techcommunity.microsoft.com/t5/networking-blog/align... it goes like this: 1. MS uses netBios. 2. apple uses bounjour, similar to netbios, but with modern conveniences, like NAT aware. 3. windows add same niceties on top of netbios and call it LLMNR. 4. apple standardize bounjour as mDNS and open it up just because they would have to publish code because of some licenses…

Thank you, Internet stranger. This LLMNR/mDNS dichotomy has been on the back of my mind for quite some time. You've made it clear.

ur welcome. parts of it are in the zero conf wikipedia page btw.

Re: KeePassXC Debian maintainer has removed all network features

#304

Post by [deleted] »

parasti wrote: post #277
YPPH wrote: post #257

Earlier quoted context omitted.

>power maintainers hold over someone else's software There's some subtle assumptions about ownership in this comment that aren't accurate, insofar as free and open source software is concerned. FOSS software is not "someone else's" software. They may own the trade mark, but by releasing the software under a FOSS licence, they lose the right to control the direction the software may take. I'm free to copy it, edit it,…

That's besides the point. You can do whatever with the software, but it gets muddy when you then release it under the same name as the original. That name may not be trademarked, but it is still not yours to use.

[deleted]

Re: KeePassXC Debian maintainer has removed all network features

#305

Post by YPPH »

parasti wrote: post #277
YPPH wrote: post #257

Earlier quoted context omitted.

>power maintainers hold over someone else's software There's some subtle assumptions about ownership in this comment that aren't accurate, insofar as free and open source software is concerned. FOSS software is not "someone else's" software. They may own the trade mark, but by releasing the software under a FOSS licence, they lose the right to control the direction the software may take. I'm free to copy it, edit it,…

That's besides the point. You can do whatever with the software, but it gets muddy when you then release it under the same name as the original. That name may not be trademarked, but it is still not yours to use.

This simply is irrelevant. A FOSS licence fully permits what Debian has done here. So, that is beside the point.

Re: KeePassXC Debian maintainer has removed all network features

#306

Post by iso8859-1 »

mikl wrote: post #187
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

Whether his changes are good or not, it’s still pretty crazy to essentially fork an open source project, but publish your very different version under the same name.

Why does setting build flags constitute a fork?

Re: KeePassXC Debian maintainer has removed all network features

#307

Post by LoganDark »

thaumaturgy wrote: post #228
roenxi wrote: post #209

Earlier quoted context omitted.

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding. > Package maintainers aren't self-sacrificial saints or all that unique as volunteers go. If you want keepassx, you can go install it. If you want the Debian a…

> Connecting the internet and a password database together is one of those fundamentally bad ideas. Disagree. I use KeePassXC because I would prefer to have my passwords on my computer, instead of somebody else's computer (and I am willing to accept responsibility for managing my own password file). That is a delineation that is parallel to, but not the same as, "don't connect to the internet". Browser integration is…

> Browser integration is a required feature for a modern password manager; without it, you don't have a password manager, you have an encrypted notepad.

Not really? I've been using KeePassXC without a browser extension for a while, probably not years but certainly many months. That doesn't make it any less of a password manager - it lets me generate random strings to use for each account, keeps them safe and encrypted, and also lets me enable TOTP for an unlimited number of accounts. That's pretty much a password manager to me (TOTP is extra but much appreciated).

Re: KeePassXC Debian maintainer has removed all network features

#308

Post by Snetry »

kasabali wrote: post #267
skjoldr wrote: post #262

Earlier quoted context omitted.

If I have both enabled in my install, which I specifically chose to, then upgrading the package locks me out of my database, because those features are not compiled.

Jeez, then you simply install the keepassxc-full package and move on. It's not like you store your sudo password in keepass database, too.

but that is part of the problem: this isn't clearly communicated to the end user in the future or present.

Current users will have their install broken and need to google to figure out what is going on.

Future users will install `keepassxc` thinking it would be actually KeePassXC before potentially realizing its a minimal version.

Personally I think splitting it into `keepassxc-full` and `keepassc-minimal` would be better since it moves the choice to the user instead of implying the contents.

Re: KeePassXC Debian maintainer has removed all network features

#309

Post by guilhas »

valicord wrote: post #295
guilhas wrote: post #289

Earlier quoted context omitted.

Everyone using an offline password manager without having a backup might as well consider everything lost This sounds like emotional blackmail How many times I lost everything, hardware failure, updates that broke OS, using dd in the wrong drive...

How would a backup help in this scenario? The data is fine, it's the application that stopped working.

If the yubikey stops working, you also loose access to the database

So I would have a backup with a simple password, or even unencrypted in a USB somewhere

Re: KeePassXC Debian maintainer has removed all network features

#310

Post by paulryanrogers »

kasabali wrote: post #270
paulryanrogers wrote: post #225

Earlier quoted context omitted.

One doesn't expect such a drastic ... 'fix' in a point release though.

You're talking as if it's a point release of Debian. It is not. It happened in sid/testing, that's what these releases are for. Whether it happened in a point or major release of Keepassxc is irrelevant, because ignorant users who upgrade their sid/testing installations blindly as if it was stable-security would have hit it eventually.

IMO insisting on a change like this would require retiring the original, un-suffixed name. And making separate -min and -full packages instead.
Post reply on HN