Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

101–110 of 210 posts

Re: Why does Debian change software?

#101

Post by RetroTechie »

upofadown wrote: post #58
lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

Debian does a lot of patching that is not strictly required for distribution reasons. Here are the GnuPG patches for example: * https://udd.debian.org/patches.cgi?src=gnupg2&version=2.4.7-... There is a lot of political stuff in there related to standards. For a specific example see: * https://sources.debian.org/src/gnupg2/2.4.7-19/debian/patche... The upstream GnuPG project (and the standards faction they belong to)…

> There is a lot of political stuff in there related to standards.

To be fair, in Debian's case politics come with the territory. Debian is a vision of what an OS should be like. With policies, standards & guidelines aimed at that, treating the OS as a whole.

That goes well beyond "gather packages, glue together & upload".

Same goes for other distributions I suppose (some more, some less).

Re: Why does Debian change software?

#102

Post by esperent »

mschuster91 wrote: post #71
sneak wrote: post #49

Earlier quoted context omitted.

IIRC it just hardcodes the release date and complains if it is more than 2 or 3 years later. It’s somewhat reasonable. I agree Debian should patch out phone-home and autoupdate (aka developer RCE). They should have left the xscreensaver local-only warning in, though. It is not a privacy or system integrity issue. jwz however is also off the rails with entitlement. They’re both wrong.

> jwz however is also off the rails with entitlement. Always remember to not link to his site from HN because you'll get a testicle NSFW image when you click on a link to his site from HN. dang used to have rel=noreferrer on outgoing links, but that led to even more drama with other people... Some people in the FOSS scene just love to stir drama, and jwz is far from the only one. Another person with such issues IMHO…

> Always remember to not link to his site from HN because you'll get a testicle NSFW image

What's his reason for targeting HN users this way?

Re: Why does Debian change software?

#103

Post by diggan »

rmccue wrote: post #97
diggan wrote: post #93

Earlier quoted context omitted.

> it fucking sucked that they made source modifications As a maintainer, I can certainly understand how it feels like that, I'd probably wouldn't feel great about it either. As a user, I'm curious what kind of modifications they felt were needed, what exactly did they change in your library?

The library I was maintaining (SimplePie) was an RSS feed parser which supported every flavour of the RSS/Atom specs. Because of the history of those particular formats, there were a huge number of compatibility hacks necessary to parse real-world data, and cases where the "spec" (actually just a vague page on a website) was inaccurate compared to actual usage. This was a while ago (10+ years), but my recollection is…

Ah, that sounds like a terrible solution from Debian's side, and very unexpected. Sure, patching security/privacy issues kind of makes sense (from a user's POV), but change functionality like that? Makes less sense, especially if they didn't even try to get the changes upstream.

Re: Why does Debian change software?

#104

Post by lukan »

moffkalast wrote: post #89
diggan wrote: post #70

Earlier quoted context omitted.

To be even more honest, it is what you make of it ¯\_(ツ)_/¯

Windows is also what you make it with enough registry hacks, I'm not recommending it to anyone though.

Well, but windows comes with spyware by default and tries to activly keep it that way. A registry hack might stop working anytime.

Windows is activly hostile to anything privacy related.

Arch comes with the default of do it yourself. Lots of footguns, but not hostile OS behavior. Great difference to me.

Re: Why does Debian change software?

#105

Post by diggan »

moffkalast wrote: post #89
diggan wrote: post #70

Earlier quoted context omitted.

To be even more honest, it is what you make of it ¯\_(ツ)_/¯

Windows is also what you make it with enough registry hacks, I'm not recommending it to anyone though.

Not really, sometimes it forces me to apply updates on shutdown/restart, even though I don't want to do it. None of the registry hacks seems to be able to disable this behavior. I've heard some people talking about a special distribution/version of Windows where you can disable this, but don't really feel like re-installing the entire OS just so when I boot into/away from Windows I don't get forced to wait for the slow update twice (one now, another in the future when I boot Windows next time).

All because Ableton cannot be bothered to support Linux :/ I understand that though, just sucks...

Re: Why does Debian change software?

#106

Post by akdev1l »

winternewt wrote: post #96
exiguus wrote: post #73

Earlier quoted context omitted.

Most good stuffed Distros do this. For example SUSE recently banned a package because of "calling home" e.g. did side-leading. https://security.opensuse.org/2025/05/07/deepin-desktop-remo... Debian indeed does this. In release FF has disabled telemetry: https://wiki.debian.org/Firefox

I wouldn't think the Firefox license allows them to do that. I thought only binaries built by Mozilla could use the FF brand.

That’s the reason for a while we had IceWeasel

Re: Why does Debian change software?

#107

Post by BarbaryCoast »

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This is no longer true.

Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox.

And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract.

The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule.

What used to be a distro by sysadmins for sysadmins, and which prized stability over timeliness has been overtaken by Ubuntu and the Freedesktop.Org people. I've been running Debian since version 3, and I used to go _years_ between crashes. These days, the only way to avoid that is to 1) rip out all the Freedesktop.Org code (pulseaudio, udisks2, etc.), and 2) stick with Debian 9 or lower.

Re: Why does Debian change software?

#108

Post by hedora »

deng wrote: post #86
RetroTechie wrote: post #84

Earlier quoted context omitted.

> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition . It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort…

> Telemetry contains personal data by definition. No. Please look up the definition of "telemetry" and "personal data". The latter always refers to an identifiable person.

Virtually all anonymization schemes are reversible, so “identifiable” isn’t carrying any weight in your definition.

“Person” isn’t either, unless the software knows for sure it’s not being uses by a person.

Re: Why does Debian change software?

#109

Post by enfuse »

deng wrote: post #69
pjmlp wrote: post #65

Earlier quoted context omitted.

So they have their own Go fork? Just one possible example, among many others that have telemetry code into them.

No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…

> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry, so there's no need for a fork.

This changed somewhat recently. Telemetry is enabled by default (I think as of Golang 1.23?)

I am only aware since I relatively recently ran into something similar to this on a fresh VM without internet egress: https://github.com/golang/go/issues/68976

https://github.com/golang/go/issues/68946

If golang doesn't fully address this I guess Debian really should at least change the default (of they haven't already).

Re: Why does Debian change software?

#110

Post by jchw »

sshine wrote: post #13
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This policy is missing from nixpkgs, although there is a similar policy for the build process for technical reasons. So I can add spotify or signal-desktop to NixOS via nixpkgs, and they won’t succeed at updating themselves. But they might try, which would be a violation of Debian’s guidelines. It’s a tough line — I like modern, commercial software that depends on some service architecture. And I can be sure it will…

To be fair, we (Nixpkgs maintainers) do remove or disable features that phone home sometimes even though it's not policy. That said, it would be nice if it was policy. Definitely was discussed before (most recently after the devbox thing I guess.)
Post reply on HN