Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

321–330 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#321
post #266
post #261

Earlier quoted context omitted.

So the Debian maintainer complains about the upstream project (which they decided to maintain the package for) bringing "crap" and having "utterly misguided" development? And somehow people say that this is the reasonable person here, basing a major change of a software's featureset on such an opinion? Independent from whether the original change is good or bad, so much of what's wrong with Open Source is people tryi…

what leads you to suspect he's wrong? from the quotes in your comment i suspect it's his choice to use plain language and openly disagree with others. in my experience that's how trustworthy, competent people talk people working together successfully in free software doesn't depend on them having the same values or getting along or wanting the software to do the same thing. it just depends on being clear and open abo…

I suspect he's wrong because he's disabled some of KeepassXC's most important security features.

One of the largest security threats to users is phishing websites, getting an email and clicking a link, and then typing your actual password into some fake hacker's webpage.

Having browser integration in your password manager, such that it auto-enters the right password on "real-bank.com", but doesn't enter it on "rel-bank.com", is a strong protection against phishing.

The maintainer disabled the browser integration for KeepassXC, which forces users to copy+paste passwords into webpage's password inputs, making them significantly more vulnerable to phishing.

Their fear-mongering about supply-chain attacks and bugs in more LoC is silly when compared to the very real threat of phishing attacks, which are way more prevalent and a way more severe threat.

Re: KeePassXC Debian maintainer has removed all network features

#322

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Kind of interesting actually. In the 2000s/2010s it was quite normal that distributions provided modified packages. Maybe not necessarily function-wise but theming, config files to a degree that interoperability wasn't the best. Even more funny that this is done now by Debian which always had a reputation of providing vanilla packages... But I guess after the xz debacle this is getting a new kind of attention

If this was the first time they were packaging keepassxc, this would be fine. If they instead chose to remove the keepassxc package and provide two new packages, keepassxc-minimal and keepassxc-full, it would be fine. It's the fact that the main package that people already have installed will no longer have functionality that many users depend on, breaking their configurations after an update.

Re: KeePassXC Debian maintainer has removed all network features

#323

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

IF apple said "hey we edited your app because we think its more secure"... People would have torches and pitchforks out. But a deb maintainer does it and there is debate? If there was a security issue then the insecure version should NOT be available. But again this is not the case. In an App Store world, the role of mainainter has to change. The job is to make the software work with the distro, not keep the name and…

people did not have their pitchforks out for (although not exactly a cve thing) https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-securi...

Re: KeePassXC Debian maintainer has removed all network features

#325

Earlier quoted context omitted.

All they did was change the XC_ALL build parameter to OFF [0] which happens to be the default in upstream's CMakeLists.txt [1]. If upstream thinks this functionality is so important maybe they should fix their defaults. I think it's a bit unfortunate that users of this package may be confused why stuff stops working when they upgrade, but having the unsuffixed package match upstream defaults seems entirely reasonable…

> If upstream thinks this functionality is so important maybe they should fix their defaults. > none of these features are plugins. All of them are built-in functionality that belong to the main product. If anything, we will reduce the number of such compile-time flags in the future, so these things cannot be disabled anymore. https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

That's certainly their prerogative, but I guess what I'm really trying to say is it's weird that they're so bent out of shape about a distro maintainer using a build option they added to their own code. Especially when said maintainer set it to the default they themselves set. If you were to download the source from github and follow the instructions in INSTALL.md which specify "Recommended CMake Build Parameters" you will end up with a binary with the exact same feature set as what the debian package now has.

>> none of these features are plugins.

I wasn't going to comment on this because it's a bit petty and is ultimately a boring semantic argument, but since you quoted it in a reply to me I will. Their CMakeLists.txt literally refers to these as plugins in the description of the XC_ALL param that was changed: "Build in all available plugins"

Re: KeePassXC Debian maintainer has removed all network features

#326
post #52

Earlier quoted context omitted.

The role of a maintainer is more than copying and pasting upstream. They are allowed to exercise their judgement in what they believe is appropriate for end users of a distribution. In this case, there does seem to be reasonable security justifications for it, and an alternative is provided.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

Obligatory article, "I am not a supplier.": https://www.softwaremaxims.com/blog/not-a-supplier>

Folks that disagree with a maintainer's actions are generally free to fork the project and maintain an alternative -- that's one of the primary features of open source software. And if end users prefer that new fork to the original maintainer's version, that'll probably be the one that survives.

But maintainers have no obligation to make their end users happy.

Re: KeePassXC Debian maintainer has removed all network features

#327
This should have been handled the same way Mozilla handles Firefox. KeepAssXC developers, file for trademark protection and then send a cease and desist to Debian legal.

If they want to misrepresent your application to Debian users, they'll have to do it under a different name or not at all.

Re: KeePassXC Debian maintainer has removed all network features

#328

Earlier quoted context omitted.

How would a backup help in this scenario? The data is fine, it's the application that stopped working.

If the yubikey stops working, you also loose access to the database So I would have a backup with a simple password, or even unencrypted in a USB somewhere

What you usually do with YubiKeys is have multiple of them so that if the key stops working or you lose it you can use the spare.

This is more secure than using a simple password or (gasp) an unencrypted copy somewhere.

Re: KeePassXC Debian maintainer has removed all network features

#329

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Debian is the only distro with this weird attitude of disregard towards upstream.

I maintain two upstream projects where Debian unilaterally decided to rename the package. In one case I found out much later, in the other case it was against my express objection and was completely nonsensical.

Of course I’m the one who has to explain it to users.

Edit: see the arrogance of the Debian guy (Julian) here: https://github.com/keepassxreboot/keepassxc/issues/10725#iss... - that’s what I’m talking about.

Re: KeePassXC Debian maintainer has removed all network features

#330
I see in this an attitude that's become increasingly common since the 2010s among developers as well as software companies regardless of open source or proprietary - "We know what's good for you, the end user and we will decide on your behalf." and use this as an excuse to strip out features that had been long available. Firefox is a classic example.

In stark contrast to the previous norm of highly customizable software that catered to both newbies and power users. Right here we see the example of the maintainer unilaterally deciding to strip out a feature that's already been disabled, just because he decided he knows better what KeepassXC users ought to do.

Post reply on HN