Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

331–340 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#331

Post by Kwpolska »

mikepavone wrote: post #325
c-hendricks wrote: post #320

Earlier quoted context omitted.

> If upstream thinks this functionality is so important maybe they should fix their defaults. > none of these features are plugins. All of them are built-in functionality that belong to the main product. If anything, we will reduce the number of such compile-time flags in the future, so these things cannot be disabled anymore. https://github.com/keepassxreboot/keepassxc/issues/10725#iss...

That's certainly their prerogative, but I guess what I'm really trying to say is it's weird that they're so bent out of shape about a distro maintainer using a build option they added to their own code. Especially when said maintainer set it to the default they themselves set. If you were to download the source from github and follow the instructions in INSTALL.md which specify "Recommended CMake Build Parameters" yo…

INSTALL.md [0] recommends passing -DWITH_XC_ALL in the Build Steps section.

This build option exists. If you're building from source and don't need any of the extra features, you can use it to get a leaner binary. But the Debian maintainer made this decision for everybody, removing important security features (such as browser integration and YubiKey support) from the main `keepassxc` package, which broke people's existing installations, and which means that people blindly running `sudo apt install keepassxc` will get an inferior, less secure product.

[0] https://github.com/keepassxreboot/keepassxc/blob/develop/INS...

Re: KeePassXC Debian maintainer has removed all network features

#332

Post by Kwpolska »

Daviey wrote: post #279
Kwpolska wrote: post #96

Earlier quoted context omitted.

This isn’t the project maintainer we’re talking about, it’s the Debian package maintainer. Their job is building a working .deb with working software, not randomly messing with it. Users have the right to demand their packages to be trustworthy.

demand ? Perhaps if you are unhappy you should ask for a refund. I just can't get my head around this sort of entitlement.

What do you propose instead? Why should users always accept and agree with the Debian maintainers' choices, even if they're dumb and produce insecure software? Why should being a volunteer give you a get out of jail free card?

Re: KeePassXC Debian maintainer has removed all network features

#333

Post by Kwpolska »

kasabali wrote: post #264
thaumaturgy wrote: post #86

Earlier quoted context omitted.

Users should be asked if they actually wanted the features in the existing package after all? Why shouldn't users have been asked before changing the existing package? I'm one of those users. If I'm loud, does that mean my opinion doesn't count anymore?

> Why shouldn't users have been asked before changing the existing package? They were. apt shows the NEWS file during update when there's a change.

I don't recall ever seeing that on Debian and derivatives.

Re: KeePassXC Debian maintainer has removed all network features

#334

Post by Dylan16807 »

m-p-3 wrote: post #315
fullspectrumdev wrote: post #293

Earlier quoted context omitted.

With Debian I expect sensible default configs, but not “we deleted a load of actual features”. In this case it’s features that were patched out - not plugins or a mere config change.

KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options. The Debian package wasn't shipping the correct default configuration in the first place, it's unfortunate but better late than never, and it's not like you can't switch to the keepassxc-full package.

> KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options.

The devs said they're not actually plugins, and that was quoted here hours before you commented.

Re: KeePassXC Debian maintainer has removed all network features

#335

Post by kasabali »

hoffs wrote: post #313
kasabali wrote: post #267

Earlier quoted context omitted.

Jeez, then you simply install the keepassxc-full package and move on. It's not like you store your sudo password in keepass database, too.

How would you know in the first place

apt shows the NEWS file during update when there's a change.

If it doesn't (ie. you set it up to blindly do the upgrade), you can still check the news file or .debian.changelog.gz file afterwards.

Lastly, when it's shipped in the new major Debian stable release in a few years, it'll surely be noted in the release notes.

Re: KeePassXC Debian maintainer has removed all network features

#336

Post by kasabali »

Snetry wrote: post #308
kasabali wrote: post #267

Earlier quoted context omitted.

Jeez, then you simply install the keepassxc-full package and move on. It's not like you store your sudo password in keepass database, too.

but that is part of the problem: this isn't clearly communicated to the end user in the future or present. Current users will have their install broken and need to google to figure out what is going on. Future users will install `keepassxc` thinking it would be actually KeePassXC before potentially realizing its a minimal version. Personally I think splitting it into `keepassxc-full` and `keepassc-minimal` would be b…

How more clearly do you expect it to be communicated?

apt shows the NEWS file during update when there's a change. If it doesn't (ie. user set it up to blindly do the upgrade), you can still check the news file or .debian.changelog.gz file afterwards.

And note that this happened in testing/sid channel, where breakage is supposed to be happen. When this change shipped in the new major Debian stable release in a few years, it'll surely be clearly written in the release notes.

What else do you expect, SMS notification? :P

If a user haven't seen the above he for sure won't see an announcement in a crowded debian-whatever-announce mailing list he isn't subscribed to or an obscure blog post posted somewhere he doesn't follow.

Re: KeePassXC Debian maintainer has removed all network features

#337

Post by kasabali »

Kwpolska wrote: post #333
kasabali wrote: post #264

Earlier quoted context omitted.

> Why shouldn't users have been asked before changing the existing package? They were. apt shows the NEWS file during update when there's a change.

I don't recall ever seeing that on Debian and derivatives.

I can only talk for Debian, not derivatives.

You definitely see it for several packages during dist-upgrades. Same in sid/testing except it can be any time though it's a rare event.

In case apt/dpkg is configured to ignore those, information still resides in /usr/share/doc/

it'll also be put in the release notes when the next major Debian version is released.

I mean, distributions have already figured these things out 20 years ago, but I guess users nowadays expect these to be announced in Twitter or a pinned Github issue or something :-<

Re: KeePassXC Debian maintainer has removed all network features

#338

Post by kasabali »

vsl wrote: post #329
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

Debian is the only distro with this weird attitude of disregard towards upstream. I maintain two upstream projects where Debian unilaterally decided to rename the package. In one case I found out much later, in the other case it was against my express objection and was completely nonsensical. Of course I’m the one who has to explain it to users. Edit: see the arrogance of the Debian guy (Julian) here: https://github.…

What was your package named?

Re: KeePassXC Debian maintainer has removed all network features

#339

Post by kasabali »

jdbernard wrote: post #322
blablabla123 wrote: post #317

Earlier quoted context omitted.

Kind of interesting actually. In the 2000s/2010s it was quite normal that distributions provided modified packages. Maybe not necessarily function-wise but theming, config files to a degree that interoperability wasn't the best. Even more funny that this is done now by Debian which always had a reputation of providing vanilla packages... But I guess after the xz debacle this is getting a new kind of attention

If this was the first time they were packaging keepassxc, this would be fine. If they instead chose to remove the keepassxc package and provide two new packages, keepassxc-minimal and keepassxc-full, it would be fine. It's the fact that the main package that people already have installed will no longer have functionality that many users depend on, breaking their configurations after an update.

> people already have installed will no longer have functionality that many users depend on, breaking their configurations after an update.

They'll have to type apt install keepassxc-full ENTER after reading about the packaging change which they've been shown during package update.

Wow what a nuisance.

Re: KeePassXC Debian maintainer has removed all network features

#340

Post by kasabali »

jdbernard wrote: post #292
int_19h wrote: post #195

Earlier quoted context omitted.

Debian does this all the time. There are thousands of .deb packages that are built with patches. In this case, though, it's not even a patch - it's a build flag that is provided by upstream.

The fact that they are customizing the software is not really the issue. The issue is that they are making a change that will remove significant functionality and in some cases completely lock some users out of their password database, which is a huge deal. Imagine if you wake up tomorrow, run a software update and then can't log in to your bank? I imagine the reason this has blown up so much is that the maintainer n…

> Imagine if you wake up tomorrow, run a software update and then can't log in to your bank

Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.

Post reply on HN