Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

351–360 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#351

Post by Liskni_si »

jeffalyanak wrote: post #349
Liskni_si wrote: post #348

Earlier quoted context omitted.

It not only _is_ the obvious choice, it is _exactly_ what has actually happened in Debian: https://salsa.debian.org/debian/keepassxc/-/commit/7d6d16e3f... The original post is just a badly written clickbait. Nothing was removed, it was just moved to the keepassxc-full package.

I don't believe you're correct. It seems like the option that Debian decided on _will_ remove those features for users who are upgrading a package. Users who already have the keypassxc package will need to explicitly switch packages if they want the full one. That's not the same behaviour as described in my quote comment.

Right, I should have been more careful with the word "exactly". I don't think the proposed solution can be implemented, though.

If the "keepassxc" package is to be replaced by the two alternatives ("keepassxc-full" and "keepassxc-minimal"), you'd still need a transitional dummy package named "keepassxc". That package would depend on "keepassxc-full | keepassxc-minimal", giving the user a choice to satisfy the dependency by installing either of those. So far so good. What if the user doesn't explicitly choose, though? The idea is that an upgrade would keep the "-full" variant but "apt install keepassxc" would pull in the "-minimal" variant. How do you encode this in Debian package metadata?

I think both "apt install" and "apt full-upgrade" will simply choose the first alternative, so you get either "-full" in both scenarios, or "-minimal" in both.

Re: KeePassXC Debian maintainer has removed all network features

#352

Post by LightFog »

Kwpolska wrote: post #333
kasabali wrote: post #264

Earlier quoted context omitted.

> Why shouldn't users have been asked before changing the existing package? They were. apt shows the NEWS file during update when there's a change.

I don't recall ever seeing that on Debian and derivatives.

Me neither in Sid - I guess they installed the listchanges package some time and forgot.

Re: KeePassXC Debian maintainer has removed all network features

#353

Post by LightFog »

kasabali wrote: post #340
jdbernard wrote: post #292

Earlier quoted context omitted.

The fact that they are customizing the software is not really the issue. The issue is that they are making a change that will remove significant functionality and in some cases completely lock some users out of their password database, which is a huge deal. Imagine if you wake up tomorrow, run a software update and then can't log in to your bank? I imagine the reason this has blown up so much is that the maintainer n…

> Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.

Are you sure it was shown? I didn’t see one on Sid.

Re: KeePassXC Debian maintainer has removed all network features

#354

Post by Daviey »

Kwpolska wrote: post #332
Daviey wrote: post #279

Earlier quoted context omitted.

demand ? Perhaps if you are unhappy you should ask for a refund. I just can't get my head around this sort of entitlement.

What do you propose instead? Why should users always accept and agree with the Debian maintainers' choices, even if they're dumb and produce insecure software? Why should being a volunteer give you a get out of jail free card?

I propose request, rather than demand. If you don't agree with the maintainers choice and it is a legitimate issue, you could raise the issue with the Debian community and try to get some more support. Alternatively, suggest a fix that meets both requirements (such as a -full package).

There is no get out jail card here... just people volunteering their time, and a subset of users that feel they have some sort of entitlement. If I volunteer to pick up trash at my local park, would you demand that I pick up your garbage? No.. that would make you a jerk.

I'm an inactive Debian Maintainer and retired Ubuntu core dev, so perhaps my views are biased.. but I really think people should show these volunteers more respect.

Re: KeePassXC Debian maintainer has removed all network features

#355

Post by [deleted] »

valicord wrote: post #201
barbariangrunge wrote: post #92

Earlier quoted context omitted.

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

If you claim to distribute application FooBar, you owe it to the authors of said application to actually distribute FooBar and not something else that was modified against their wishes. If you want to distribute a modified version, you should call it something other than FooBar. You also owe it to your users to not mislead them by claiming that your modified version is actually the real FooBar.

[deleted]

Re: KeePassXC Debian maintainer has removed all network features

#356

Post by kasabali »

LightFog wrote: post #352
Kwpolska wrote: post #333

Earlier quoted context omitted.

I don't recall ever seeing that on Debian and derivatives.

Me neither in Sid - I guess they installed the listchanges package some time and forgot.

It is marked as 'Priority: standard' thus installed as part of the standard Debian installation and shows only NEWS entries by default without needing further configuration.

Re: KeePassXC Debian maintainer has removed all network features

#357

Post by kasabali »

redserk wrote: post #345
kasabali wrote: post #340

Earlier quoted context omitted.

> Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.

The snark here is unnecessary and completely disconnected from how people use these systems in the real world. Deferring to “it’s in the notes!” means nothing if you have more than a handful of packages on your machine. You should also clarify the assertion that packaging affecting testing target won’t eventually hit stable, because that would be a major change that I haven’t heard about. An end user will get impacte…

> “it’s in the notes!”

Your words, not mine.

It isn't buried somewhere, it's in NEWS.Debian file, and it's shown to user during the package update by default.

Re: KeePassXC Debian maintainer has removed all network features

#358

Post by kasabali »

LightFog wrote: post #353
kasabali wrote: post #340

Earlier quoted context omitted.

> Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.

Are you sure it was shown? I didn’t see one on Sid.

It's in NEWS.debian file [0], so apt-listchanges (which is installed by default in standard installation) should've shown it.

[0] https://salsa.debian.org/debian/keepassxc/-/blob/main/debian...

Re: KeePassXC Debian maintainer has removed all network features

#359

Post by danpalmer »

rationably wrote: post #298
danpalmer wrote: post #256

We used to deploy on Debian at my previous place, and we hit this sort of shit all the time. Maintainer ripped out features they disagreed with (political reasons, or just engineering/product taste), maintainers changing the configuration files to things that suited them better, etc. I understand it's all volunteer work, I understand it's open source so anyone can add their own custom packaging, on top, but Debian (t…

Could you provide an example where maintainer "ripped out" a feature because of a strictly political reason?

When I say "political" I'm referring more to belief systems, but calling them religious beliefs would be far too antagonistic for the point I'm trying to make.

Iceweasel is full of examples of parts of Firefox removed because the maintainers had personal disagreements on the values of Firefox. Firefox is a fairly privacy-forward browser and Mozilla stand up for a lot of those ideals, and yet Iceweasel pulls features and telemetry on the basis of them being by-definition bad. I think that's a politics/identity statement more than a UX improvement.

I strongly disagree with packagers putting their opinion on top of the software they are packaging, I think packaging should be as pure a translation as is possible for the target system. Now in the case of Iceweasel it could change the branding which I think would give them more leeway to put opinion into it as it's "not Firefox" and there's little risk of users being confused, but I'd also bet that Debian wouldn't accept another pure Firefox packaging because it would duplicate the package in their minds. If that is the case I think that nullifies the idea.

Re: KeePassXC Debian maintainer has removed all network features

#360

Post by sternchenfee17 »

nrabulinski wrote: post #284
roenxi wrote: post #224

Earlier quoted context omitted.

> Volunteers by definition do not (or at least should not) expect anything in return for their time That isn't really true. For starters, paid volunteers are actually a thing that happens from time to time. Secondly; there would be no volunteers if they didn't get something for their time. It is just generally that something isn't money. Volunteers aren't expected to be selfless.

If you’re getting paid you’re by definition not a volunteer. You may be getting some perks like volunteering at a convention giving you an entry pass for that convention, but as soon as you’re getting some other gains, be it monetary or not, you’re no longer a volunteer.

each year, my employer allows me to take a (paid) day off to do volunteering projects, e.g. going to soup kitchens. I get paid for that day regularly by my employer. The soup kitchen doesn't have to pay a dime.

Am I a volunteer?

Post reply on HN