Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

361–367 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#361

Post by m-p-3 »

Dylan16807 wrote: post #334
m-p-3 wrote: post #315

Earlier quoted context omitted.

KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options. The Debian package wasn't shipping the correct default configuration in the first place, it's unfortunate but better late than never, and it's not like you can't switch to the keepassxc-full package.

> KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options. The devs said they're not actually plugins, and that was quoted here hours before you commented.

The documentation should be updated to reflect this, because at this time

https://github.com/keepassxreboot/keepassxc/wiki/Building-Ke...

    -DWITH_XC_ALL=[ON|OFF] Enable/Disable compiling all plugins above (default: OFF)
still use the plugins terminology

Re: KeePassXC Debian maintainer has removed all network features

#362

Post by mikepavone »

Kwpolska wrote: post #331
mikepavone wrote: post #325

Earlier quoted context omitted.

That's certainly their prerogative, but I guess what I'm really trying to say is it's weird that they're so bent out of shape about a distro maintainer using a build option they added to their own code. Especially when said maintainer set it to the default they themselves set. If you were to download the source from github and follow the instructions in INSTALL.md which specify "Recommended CMake Build Parameters" yo…

INSTALL.md [0] recommends passing -DWITH_XC_ALL in the Build Steps section. This build option exists. If you're building from source and don't need any of the extra features, you can use it to get a leaner binary. But the Debian maintainer made this decision for everybody, removing important security features (such as browser integration and YubiKey support) from the main `keepassxc` package, which broke people's exi…

> INSTALL.md [0] recommends passing -DWITH_XC_ALL in the Build Steps section.

You're right, I missed it there. Silly me for assuming that all of the recommended CMake flags would be specified in the section titled "Recommended CMake Build Parameters"

Re: KeePassXC Debian maintainer has removed all network features

#363

Post by hughsient »

1oooqooq wrote: post #188
DDiggler wrote: post #134

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3]. Absolutely insan…

why fish for fwupd? systemd-resolved which is everywhere, will open (at request) an LLMNR server (a.k.a. mDNS, nee microsoft netbios) on port 5355. With IoT everyone have access to your LAN, so now people are making sure linux also join the REDACTED party btw, fix for fwupmdg, since they have a low quality default conf file without commented out defaults: ``` # /etc/fwupd/fwupd.conf [fwupd] P2pPolicy=none ``` fix for…

> since they have a low quality default conf file without commented out defaults

Try `man fwupd.conf` for all the options.

Re: KeePassXC Debian maintainer has removed all network features

#364

Post by Ferret7446 »

LoganDark wrote: post #307
thaumaturgy wrote: post #228

Earlier quoted context omitted.

> Connecting the internet and a password database together is one of those fundamentally bad ideas. Disagree. I use KeePassXC because I would prefer to have my passwords on my computer, instead of somebody else's computer (and I am willing to accept responsibility for managing my own password file). That is a delineation that is parallel to, but not the same as, "don't connect to the internet". Browser integration is…

> Browser integration is a required feature for a modern password manager; without it, you don't have a password manager, you have an encrypted notepad. Not really? I've been using KeePassXC without a browser extension for a while, probably not years but certainly many months. That doesn't make it any less of a password manager - it lets me generate random strings to use for each account, keeps them safe and encrypte…

It makes you vulnerable to phishing (or rather, it provides zero protection against phishing), which is one of the biggest threats to the average user by a wide margin.

It's absolutely reasonable to say "Browser integration is a required feature for a modern password manager".

Re: KeePassXC Debian maintainer has removed all network features

#365

Post by ranger_danger »

sternchenfee17 wrote: post #360
nrabulinski wrote: post #284

Earlier quoted context omitted.

If you’re getting paid you’re by definition not a volunteer. You may be getting some perks like volunteering at a convention giving you an entry pass for that convention, but as soon as you’re getting some other gains, be it monetary or not, you’re no longer a volunteer.

each year, my employer allows me to take a (paid) day off to do volunteering projects, e.g. going to soup kitchens. I get paid for that day regularly by my employer. The soup kitchen doesn't have to pay a dime. Am I a volunteer?

to the soup kitchen, yes, you are, if they aren't paying you.

Re: KeePassXC Debian maintainer has removed all network features

#366

Post by ranger_danger »

Kwpolska wrote: post #142
sangnoir wrote: post #131

Earlier quoted context omitted.

> Their job is building a working .deb with working software If that were was all there is to packaging - upstream developers could do the same job & have their CI/CD pipeline shoot out a .deb file. However, it's not unheard of for package managers to maintain an evolving patchset that changes the default behavior and better integrates the upstream project to the rest of the distribution and its philosophy.

Upstream developers don’t have the time and bandwidth to set up packaging for all distros and versions. Improving defaults may be fine according to some. Removing major features advertised by the software due to political reasons is not fine. My software is a victim of Debian maintainers as well: they chose to remove the default theme from our static site generator, because it was built on top of Bootstrap 3, but Deb…

I think one of the potentially bigger things that doesn't yet exist is an easy way for non-developers to build their own packages with whatever options they want. By easy I mean a GUI tool that works across the majority of projects out there, and on any distro.

Re: KeePassXC Debian maintainer has removed all network features

#367

Post by skjoldr »

kasabali wrote: post #336
Snetry wrote: post #308

Earlier quoted context omitted.

but that is part of the problem: this isn't clearly communicated to the end user in the future or present. Current users will have their install broken and need to google to figure out what is going on. Future users will install `keepassxc` thinking it would be actually KeePassXC before potentially realizing its a minimal version. Personally I think splitting it into `keepassxc-full` and `keepassc-minimal` would be b…

How more clearly do you expect it to be communicated? apt shows the NEWS file during update when there's a change. If it doesn't (ie. user set it up to blindly do the upgrade), you can still check the news file or .debian.changelog.gz file afterwards. And note that this happened in testing/sid channel, where breakage is supposed to be happen. When this change shipped in the new major Debian stable release in a few ye…

I've almost never needed to read those news to keep the system working as I want it to. That's the thing.
Post reply on HN