Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

311–320 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#311

Post by m-p-3 »

thaumaturgy wrote: post #62
dannyw wrote: post #52

Earlier quoted context omitted.

The role of a maintainer is more than copying and pasting upstream. They are allowed to exercise their judgement in what they believe is appropriate for end users of a distribution. In this case, there does seem to be reasonable security justifications for it, and an alternative is provided.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

The default build of KeepassXC is without any optional modules

https://github.com/keepassxreboot/keepassxc/wiki/Building-Ke...

    -DWITH_XC_ALL=[ON|OFF] Enable/Disable compiling all plugins above (default: OFF)
To me, it seems like the maintainer is simply bringing the default package back to what it should have been, and he's offering another build with all features enabled under keepassxc-full

If KeepassXC is unhappy with the defaults, they can adjust theirs to reflect what they feel should be available out of the box.

Re: KeePassXC Debian maintainer has removed all network features

#313

Post by hoffs »

kasabali wrote: post #267
skjoldr wrote: post #262

Earlier quoted context omitted.

If I have both enabled in my install, which I specifically chose to, then upgrading the package locks me out of my database, because those features are not compiled.

Jeez, then you simply install the keepassxc-full package and move on. It's not like you store your sudo password in keepass database, too.

How would you know in the first place

Re: KeePassXC Debian maintainer has removed all network features

#314

Post by gradientsrneat »

nsajko wrote: post #191

Horrid PR for Debian. The decision is ignorant and capricious and makes Debian seem like a personal toy project instead of a FOSS cornerstone. On top of that the Debian maintainer then responds by calling upstream "crappy".

Said maintainer also does dev work for Canonical. So this probably affects optics for Ubuntu too. Although, speculating charitably, maybe the maintainer knows something we don't about the upstream's security policies.

Re: KeePassXC Debian maintainer has removed all network features

#315

Post by m-p-3 »

fullspectrumdev wrote: post #293
kiwijamo wrote: post #244

Earlier quoted context omitted.

Which is pretty much what all other Debian package maintainers do. For Debian users it's expected they ensure the software they are packaging fits in with the Debian way of doing things. This is what Debian users want -- if they wanted all packages 'nude' with no changes applied there are other distros e.g. Arch that are much better suited. I personally tried other distros which tries to package as close to upstream…

With Debian I expect sensible default configs, but not “we deleted a load of actual features”. In this case it’s features that were patched out - not plugins or a mere config change.

KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options.

The Debian package wasn't shipping the correct default configuration in the first place, it's unfortunate but better late than never, and it's not like you can't switch to the keepassxc-full package.

Re: KeePassXC Debian maintainer has removed all network features

#316

Post by valicord »

guilhas wrote: post #309
valicord wrote: post #295

Earlier quoted context omitted.

How would a backup help in this scenario? The data is fine, it's the application that stopped working.

If the yubikey stops working, you also loose access to the database So I would have a backup with a simple password, or even unencrypted in a USB somewhere

You backup the yubikey seed (whatever it's called) separately from the password db, so that the attacker still has to get 3 separate pieces of information (db, password, seed) to get the full access.

Re: KeePassXC Debian maintainer has removed all network features

#317

Post by blablabla123 »

alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Kind of interesting actually. In the 2000s/2010s it was quite normal that distributions provided modified packages. Maybe not necessarily function-wise but theming, config files to a degree that interoperability wasn't the best. Even more funny that this is done now by Debian which always had a reputation of providing vanilla packages... But I guess after the xz debacle this is getting a new kind of attention

Re: KeePassXC Debian maintainer has removed all network features

#318

Post by kiwijamo »

fullspectrumdev wrote: post #293
kiwijamo wrote: post #244

Earlier quoted context omitted.

Which is pretty much what all other Debian package maintainers do. For Debian users it's expected they ensure the software they are packaging fits in with the Debian way of doing things. This is what Debian users want -- if they wanted all packages 'nude' with no changes applied there are other distros e.g. Arch that are much better suited. I personally tried other distros which tries to package as close to upstream…

With Debian I expect sensible default configs, but not “we deleted a load of actual features”. In this case it’s features that were patched out - not plugins or a mere config change.

Which is in line with how many other Debian packages work which is again why I think this isn't really a big issue from the perspective of a Debian user. Most of the upset seem to be coming from users of other distros unfamiliar with the Debian approach to doing things. I do agree it's annoying that this wasn't done from Day 1, but better late than never.

Re: KeePassXC Debian maintainer has removed all network features

#319

Post by FdbkHb »

nsajko wrote: post #191

Horrid PR for Debian. The decision is ignorant and capricious and makes Debian seem like a personal toy project instead of a FOSS cornerstone. On top of that the Debian maintainer then responds by calling upstream "crappy".

Debian maintainers are experts at touching things they shouldn't and creating a mess in the process. The worst case, by far, was when they broke the RNG of SSH key generation:

https://jblevins.org/log/ssh-vulnkey#:~:text=In%20May%202008....

Those guys are out of control and constantly having conflicts with upstream, I'm astounded to see the amount of support I see for debian in this thread.

Re: KeePassXC Debian maintainer has removed all network features

#320

Post by c-hendricks »

mikepavone wrote: post #235
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

All they did was change the XC_ALL build parameter to OFF [0] which happens to be the default in upstream's CMakeLists.txt [1]. If upstream thinks this functionality is so important maybe they should fix their defaults. I think it's a bit unfortunate that users of this package may be confused why stuff stops working when they upgrade, but having the unsuffixed package match upstream defaults seems entirely reasonable…

> If upstream thinks this functionality is so important maybe they should fix their defaults.

> none of these features are plugins. All of them are built-in functionality that belong to the main product. If anything, we will reduce the number of such compile-time flags in the future, so these things cannot be disabled anymore.

https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

Post reply on HN