Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

51–60 of 210 posts

Re: Why does Debian change software?

#51

Post by capitol_ »

JdeBP wrote: post #42
pabs3 wrote: post #31

Earlier quoted context omitted.

Usually the Debian manual page author or package maintainer will send that upstream. Same goes for patches. Sometimes upstream doesn't want manual pages, or wants it in a different format, and the Debian person doesn't have time to rewrite it.

There's a belief that this is usual. But having watched the process for a couple of decades, it seems to me that that is just a belief, and actual practice doesn't work that way. A lot of times this stuff just gets stuck and never sent along. I also think that the idea that original authors must not accept manual pages is a way of explaining how the belief does not match reality, without accepting that it is the beli…

It's also easy for people to have the opinion the those who do the unpaid work of packaging software should do even more work for free.

I have sent about 50 or so patches upstream for the 300 packages I maintain and while it reduces the amount of work long-term it's also surprisingly amount of work.

Typically the Debian patches are licensed under the same license as the original project. So there is nothing stopping anyone who feels that more patches should be sent upstream to send them.

Typically the Debian maintai

Re: Why does Debian change software?

#52

Post by Barrin92 »

commandersaki wrote: post #45

Yeah no thanks, just look at the abomination like pure-ftpd, apache, nginx, etc. I don't need some weird opinion configuration framework to go with the software I use.

I second that. Not only are there not infrequent cases of package maintainers breaking software, it's effectively nothing but the "app store" model, having an activist distributor insert themselves between the user and software.

It's why I'm really glad flatpaks/snaps/appimages and containerization are where they are at now, because it's greatly dis-intermediated software distribution.

Re: Why does Debian change software?

#54

Post by keysdev »

diggan wrote: post #50
pabs3 wrote: post #24

Earlier quoted context omitted.

This is unfortunately not part of Debian Policy yet, and there are still lots of privacy issues of different severities in Debian. https://wiki.debian.org/PrivacyIssues

I don't use Debian for servers nor personal computers anymore, but the fact that they themselves host a page explaining potential privacy issues with Debian makes me trust them a lot more, and feel safer recommending it to others when it fits.

What are you using instead now? Nixos?

Re: Why does Debian change software?

#55

Post by diggan »

keysdev wrote: post #54
diggan wrote: post #50

Earlier quoted context omitted.

I don't use Debian for servers nor personal computers anymore, but the fact that they themselves host a page explaining potential privacy issues with Debian makes me trust them a lot more, and feel safer recommending it to others when it fits.

What are you using instead now? Nixos?

Yeah, NixOS for all servers (homelab + dedicated remote ones) and Arch on desktop.

Re: Why does Debian change software?

#56

Post by vaporary »

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

I was extremely disappointed to recently learn that visidata(1) phones home, and that this functionality has not been disabled in the Debian package, despite many people requesting its removal:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001647

https://github.com/saulpw/visidata/discussions/940

Re: Why does Debian change software?

#58

Post by upofadown »

lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

Debian does a lot of patching that is not strictly required for distribution reasons. Here are the GnuPG patches for example:

* https://udd.debian.org/patches.cgi?src=gnupg2&version=2.4.7-...

There is a lot of political stuff in there related to standards. For a specific example see:

* https://sources.debian.org/src/gnupg2/2.4.7-19/debian/patche...

The upstream GnuPG project (and the standards faction they belong to) specifically opposes the use of keys without user IDs as it is a potential security issue. It is also specifically disallowed by the RFC4880 OpenPGP standard. By working through the Debian process, the proponents of such keys are bypassing the position of the upstream project and the standard.

Re: Why does Debian change software?

#59

Post by lqet »

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

One of the many reasons I switched from Ubuntu to Debian 2 years ago. Another reason was snap.

Re: Why does Debian change software?

#60

Post by master_crab »

lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

If it involves OpenSSL, I will give the benefit of the doubt to everyone else first over OpenSSL.

Why? Heartbleed.

Post reply on HN