Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

61–70 of 210 posts

Re: Why does Debian change software?

#61

Post by gspr »

hsbauauvhabzb wrote: post #23

Do distro maintainers share patches, man pages, call home metrics and other data with other distros’ maintainers (and them back)? Further, do they publish any change information publicly?

> Do distro maintainers share patches, man pages, call home metrics and other data with other distros’ maintainers (and them back)?

Yes, at a minimum the patches are in the Debian source packages. Moreover, maintainers are highly encouraged to send patches upstream, both for the social good and to ease the distribution's maintenance burden. An automated tool to look for such patches is the "patches not yet forwarded upstream" field on https://udd.debian.org/patches.cgi

Re: Why does Debian change software?

#62

Post by master_crab »

lqet wrote: post #59
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

One of the many reasons I switched from Ubuntu to Debian 2 years ago. Another reason was snap.

Yup. Snap is emblematic of all the complexity Canonical bakes into Ubuntu.

Re: Why does Debian change software?

#63

Post by sgc »

steeleduncan wrote: post #34
hsbauauvhabzb wrote: post #23

Do distro maintainers share patches, man pages, call home metrics and other data with other distros’ maintainers (and them back)? Further, do they publish any change information publicly?

> ... do they publish any change information publicly? This is utter FUD, of course they do, it is an open source distribution. Everything can be found from packages.debian.org

They even have a portal that publishes this information specifically, with statistics, and many notes as to why a specific change has been made: https://udd.debian.org/patches

Re: Why does Debian change software?

#64

Post by gspr »

Barrin92 wrote: post #52
commandersaki wrote: post #45

Yeah no thanks, just look at the abomination like pure-ftpd, apache, nginx, etc. I don't need some weird opinion configuration framework to go with the software I use.

I second that. Not only are there not infrequent cases of package maintainers breaking software, it's effectively nothing but the "app store" model, having an activist distributor insert themselves between the user and software. It's why I'm really glad flatpaks/snaps/appimages and containerization are where they are at now, because it's greatly dis-intermediated software distribution.

Since this is the FOSS world, you are of course free to eschew distributions. But:

> it's effectively nothing but the "app store" model, having an activist distributor insert themselves between the user and software.

is just factually wrong. Distributions like Debian try to make a coherent operating system from tens of thousands of pieces of independently developed software. It's fine not to like that. It's fine to instead want to use and manage those tens of thousands of pieces of independent software yourself. But a distribution is neither an "app store", nor does it "insert itself" between the user and the software. The latter is impossible in the FOSS world. Many users choose to place distros between them and software. You can choose otherwise.

Re: Why does Debian change software?

#65

Post by pjmlp »

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

So they have their own Go fork?

Just one possible example, among many others that have telemetry code into them.

Re: Why does Debian change software?

#66

Post by lmm »

guappa wrote: post #8
lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

Do you have any statistics that show that Debian patches introduce more CVE worthy bugs than the software already contains? OpenSSL doesn't really have a pristine history. Let's not forget that the patch had been posted on the OpenSSL mailing list and had received a go ahead comment before that. Having said that, if you're asking if there's a penetration test team that reviews all the patches. No there isn't. Like th…

The patch was posted on the wrong OpenSSL mailing list, and frankly that particular Debian bug was worse than anything else we've seen even from OpenSSL.

Last I knew Debian didn't do dedicated security review of patches to security-critical software, which is normal practice for other distributions.

Re: Why does Debian change software?

#67

Post by yxhuvud »

INTPenis wrote: post #17

This is one of the reasons I switched to RHEL 10+ years ago. I actually prefer the RHEL policy of leaving packages the way upstream packaged them, it means upstream docs are more accurate, I don't have to learn how my OS moves things around. One example that sticks out in memory is postgres, RHEL made no attempt to link its binaries into PATH, I can do that myself with ansible. Another annoying example that sticks ou…

> I actually prefer the RHEL policy of leaving packages the way upstream packaged them

Unless something has changed in the last 10 years that has passed since I last used anything RHEL-based, there are definitely no such policy.

Re: Why does Debian change software?

#68

Post by layer8 »

pjmlp wrote: post #65
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

So they have their own Go fork? Just one possible example, among many others that have telemetry code into them.

“Will remove” means that it’s one of the typical/accepted reasons why patches are applied by Debian maintainers, as in meaning 4 here [0], not that there is a guarantee of all telemetry being removed.

[0] https://www.merriam-webster.com/dictionary/will

Re: Why does Debian change software?

#69

Post by deng »

pjmlp wrote: post #65
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

So they have their own Go fork? Just one possible example, among many others that have telemetry code into them.

No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system:

https://popcon.debian.org/

Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry, so there's no need for a fork.

Post reply on HN