Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

141–150 of 210 posts

Re: Why does Debian change software?

#141

Post by ryandrake »

hedora wrote: post #112
vaporary wrote: post #56

Earlier quoted context omitted.

I was extremely disappointed to recently learn that visidata(1) phones home, and that this functionality has not been disabled in the Debian package, despite many people requesting its removal: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001647 https://github.com/saulpw/visidata/discussions/940

The maintainer’s responses in that thread are really frustrating. They just keep describing the bug as though the package’s behavior is acceptable. I wonder what debian’s process is for dealing with such maintainers. I hope they make “no phone home” actual policy soon.

Infuriating. The developer is just making excuses and refusing to address the users' actual concern. And why are they phoning home in the first place? What is this critical use case that requires this intrusion?

    "This daily count of users is what keeps us working on the project, because otherwise we have feel like we are coding into a void."
So, they wrote code to phone home (by default) and then digging in and defending it... just for their feelings? You've got to be kidding me!

Re: Why does Debian change software?

#142

Post by ak217 »

kragen wrote: post #79
lmm wrote: post #66

Earlier quoted context omitted.

The patch was posted on the wrong OpenSSL mailing list, and frankly that particular Debian bug was worse than anything else we've seen even from OpenSSL. Last I knew Debian didn't do dedicated security review of patches to security-critical software, which is normal practice for other distributions.

It was plausibly the worst computer security bug in human history, but by the same token, it's hard to see it as indicating a systemic problem with either Debian or OpenSSL. When we're dealing with a once-in-history event like that, where it happens is pretty random. It's the problem of inference from a small sample.

I think it's important to learn from incidents. It's clear there were design issues on both projects' sides that allowed that bug to happen, and in fact several of them were fixed in subsequent years (though not quickly, and not until major corporate sponsors got concerned about OpenSSL's maintenance).

Re: Why does Debian change software?

#143

Post by Affric »

guappa wrote: post #11
Affric wrote: post #3

But what does Debian see as the risks of patching the software they distribute and how do they mitigate them?

Debian isn't a single person. A lot of patches are backport fixes for CVEs. Then there's stuff like: "this project only compiles with an obsolete version of gcc" so the alternatives are dropping it or fixing it. Closely related are bugs that only manifest on certain architectures, because the developers only use amd64 and never compile or run it on anything else, so they make incorrect assumptions. Then there's pytho…

I have phrased it as the author has phrased it.

What gives you the idea I think Debian are any more prone to mistakes than anyone else? It’s one of the two distros I use at home. I admire the devs a great deal.

Re: Why does Debian change software?

#144

Post by yoyohello13 »

I respect the hell out of Debian and am grateful for everything they do for the larger ecosystem, but this is why I use Arch. It's so much easier just to refer to the official documentation for the software and know it will be correct. Also, I've never really encountered a situation where interop between software is broken by just sticking to vanilla upstream. Seems like modifying upstream is just a ton of work with so many potential breakages and downsides it's not really worth it.

Re: Why does Debian change software?

#145

Post by yoyohello13 »

dfedbeef wrote: post #95
galad87 wrote: post #53

The best part is when they swap FFmpeg or other libraries, make things compile somehow, don't test the results, and then ship completely broken software.

You run another distro that does things better?

Fedora? Arch Linux? I have massive respect for the Debian maintainers, but I've had way fewer problems on those Distros.

Re: Why does Debian change software?

#146

Post by jefftk »

rmccue wrote: post #98
winternewt wrote: post #96

Earlier quoted context omitted.

I wouldn't think the Firefox license allows them to do that. I thought only binaries built by Mozilla could use the FF brand.

Indeed, Mozilla only recently allowed Debian to use the brand for their modified version: https://en.wikipedia.org/wiki/Debian%E2%80%93Mozilla_tradema...

Recently? It was almost a decade ago: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815006

Re: Why does Debian change software?

#147

Post by Bender »

deng wrote: post #125
hedora wrote: post #108

Earlier quoted context omitted.

Virtually all anonymization schemes are reversible, so “identifiable” isn’t carrying any weight in your definition. “Person” isn’t either, unless the software knows for sure it’s not being uses by a person.

By your definition, all data is PII.

Many corporate privacy policies per their customer contracts agree with this. Even a single packet regardless of contents is sending the IP address and that is considered by many companies to be PII. Not my opinion, it's in thousands of contracts. Many companies want to know every third party involved in tracking their employees. Deviating from this is a compliance violation and can lead to an audit failure and monetary credits. These policies are strictly followed on servers and less so on workstations but I suspect with time that will change.

Re: Why does Debian change software?

#148

Post by mnau »

sneak wrote: post #49
quietbritishjim wrote: post #47

Earlier quoted context omitted.

I'll admit that I haven't inspected the patch, but how could that warning possibly work without checking version information somewhere on the internet? That was listed in OP.

IIRC it just hardcodes the release date and complains if it is more than 2 or 3 years later. It’s somewhat reasonable. I agree Debian should patch out phone-home and autoupdate (aka developer RCE). They should have left the xscreensaver local-only warning in, though. It is not a privacy or system integrity issue. jwz however is also off the rails with entitlement. They’re both wrong.

People unfamiliar with code base can easily screw it, here is SimplePie example:

https://news.ycombinator.com/item?id=44061563

I don't think that approach is reasonable. When you are effectively making a fork, don't freeload on existing project name and burden him with problems you cause.

Re: Why does Debian change software?

#149

Post by 28304283409234 »

binaryturtle wrote: post #137
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

Why can't I get GNOME stop calling home? (on a Debian installation) Each time I fire up my Debian VM with GNOME here on my OSX host system Little Snitch pops up because some weird connection to a GNOME web endpoint. One major pet peeve of mine.

Please send patches.

Re: Why does Debian change software?

#150

Post by Bender »

BarbaryCoast wrote: post #107
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a…

Firefox only updates on its own if installed outside of the package manager. This applies to Debian and its forks. If I click on Help -> About it says, "Updates disabled by your organization". I personally would like to see distributions suggest installing Betterfox [1] or Arkenfox [2] to tighten up Firefox a bit.

[1] - https://github.com/yokoffing/Betterfox

[2] - https://github.com/arkenfox/user.js

Post reply on HN