Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

171–180 of 210 posts

Re: Why does Debian change software?

#171

Post by overfeed »

ak217 wrote: post #160
bityard wrote: post #153

Earlier quoted context omitted.

First I want to say that I love Debian. They have a great distro that is simple and quite frankly a joy to use, and manage to keep it all going on basically nothing but volunteer effort. However, I do believe that in certain areas, they give too much freedom to package maintainers. The bar for being a package maintainer in Debian is relatively low, but once a package _has_ a maintainer--and barring any actual Debian…

Agreed. The intent is good, but there are recurring problems that arise because of insufficient communication between the distro package maintainers and upstream, insufficient domain experience, or both. I think the solution is to set stronger expectations about what kinds of customizations maintainers should be making (in general, fewer than they make today), how to communicate with upstream, and more code review.

Users trust Debian (and in turn its maintainers) more than the upstream providers to keep the entire OS stable. Upstream, by definition, are likely to be OS-agnostic, only care about their package and perhaps their preferred dependencies.

Debian has earned that trust, and it's software update rules are battle-tested and well-understood.

Re: Why does Debian change software?

#172

Post by LtWorf »

lmm wrote: post #128
SAI_Peregrinus wrote: post #100

Earlier quoted context omitted.

On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself.

> On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself. No it wasn't. It was reading (and xoring into the randomness that would become the key being generated) uninitialised char values from an array whose address was taken, t…

Current kernels zero pages. The code was buggy to begin with.

Re: Why does Debian change software?

#173

Post by LtWorf »

master_crab wrote: post #60
lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

If it involves OpenSSL, I will give the benefit of the doubt to everyone else first over OpenSSL. Why? Heartbleed.

As some other comments say, the patch was posted to OpenSSL and someone said it was fine. They later said it wasn't a proper review.

Re: Why does Debian change software?

#174

Post by LtWorf »

yoyohello13 wrote: post #158
bityard wrote: post #156

Earlier quoted context omitted.

You seem to be implying that Debian makes large significant changes to upstream software for the sake of integration with the rest of the OS and that Arch makes none at all. Neither of these is true.

I understand it's a spectrum, but I lean toward minimal possible changes to upstream.

Also if that means the program won't run at all? Or a bug that has a patch to fix it doesn't get fixed? Or a device that could be supported is instead not supported?

I've made patches to a bunch of stuff to improve kde on mobile/tablets. After short or very long time they do get merged, but meanwhile people (like me) who own a tablet can actually use the software.

Why wait several months or even years?

Re: Why does Debian change software?

#175

Post by arp242 »

yjftsjthsd-h wrote: post #163
arp242 wrote: post #138

Earlier quoted context omitted.

I didn't ask for you to second-guess my software. I didn't ask you to ship modified (potentially broken and/or substantially different in opinionated ways) versions of my software under the same name. If you're going to do that, then you should actually let people know. Otherwise don't do it. It's not about "but the license allows it", it's about what the right thing to do is. Debian has given me the most grief of an…

> If you're going to do that, then you should actually let people know. Otherwise don't do it. It's not about "but the license allows it", it's about what the right thing to do is. Okay, I am hereby letting you know: Every single distro patches software. All of them. Debian, Arch, Fedora, Gentoo, NixOS, Alpine, Void, big, small, commercial, hobbyist. All of them.

That's simply not true. Some distros may patch a few build issues, or maybe the rare breaking bug, but nothing like what Debian does. To claim anything else is Trumpian levels of falsehood.

Re: Why does Debian change software?

#176

Post by happysadpanda2 »

ryandrake wrote: post #140
deng wrote: post #129

Earlier quoted context omitted.

Yes, so the vendor must not store it. Something along those lines is usually said in the privacy policy. If you don't trust the vendor to do that, then do not opt-in to sending data, or even better, do not use the vendor's software at all.

Sometimes, we have to or we simply want to run software from developers we don't know or entirely trust. This just means that the software developer needs to be treated as an attacker in your threat model and mitigate accordingly. I would argue that users can't inherently trust the average developer anymore. Ideas about telemetry, phoning home, conducting A/B tests and other experiments on users, and fundamentally, m…

I can't argue that you are wrong, but I can argue that, for myself, if I don't trust a developer to not screw me over with telemetry, I cannot trust the developer to not screw me over with their code. I can't think of a scenario where this trust isn't binary, either I can trust them (with telemetry AND code execution), or I can't trust them with either. Could you describe what scenario I am missing?

Re: Why does Debian change software?

#177

Post by ryandrake »

happysadpanda2 wrote: post #176
ryandrake wrote: post #140

Earlier quoted context omitted.

Sometimes, we have to or we simply want to run software from developers we don't know or entirely trust. This just means that the software developer needs to be treated as an attacker in your threat model and mitigate accordingly. I would argue that users can't inherently trust the average developer anymore. Ideas about telemetry, phoning home, conducting A/B tests and other experiments on users, and fundamentally, m…

I can't argue that you are wrong, but I can argue that, for myself, if I don't trust a developer to not screw me over with telemetry, I cannot trust the developer to not screw me over with their code. I can't think of a scenario where this trust isn't binary, either I can trust them (with telemetry AND code execution), or I can't trust them with either. Could you describe what scenario I am missing?

You’re not missing anything. In general, I don’t think you can really trust the vast majority of software developers anymore. Incentives are so ridiculously aligned against the user.

If you take the next step: “do not use software from vendors you don’t trust,” you are severely limiting the amount of software you can use. Each user gets to decide for himself whether this is a feasible trade off.

Re: Why does Debian change software?

#178

Post by parasti »

rmccue wrote: post #90

As someone who maintained a (PHP) library that Debian distributed, it fucking sucked that they made source modifications. There were a number of times where they broke the library in subtle ways, and there was little to no indication to users of the library that they were running a forked version. I also never had any contact from them about the supposed "bugs" they were patching.

Have had a similar experience as the upstream of a free game. They also sometimes forwarded those bugs to us.

Re: Why does Debian change software?

#179

Post by grayhatter »

ryandrake wrote: post #141
hedora wrote: post #112

Earlier quoted context omitted.

The maintainer’s responses in that thread are really frustrating. They just keep describing the bug as though the package’s behavior is acceptable. I wonder what debian’s process is for dealing with such maintainers. I hope they make “no phone home” actual policy soon.

Infuriating. The developer is just making excuses and refusing to address the users' actual concern. And why are they phoning home in the first place? What is this critical use case that requires this intrusion? "This daily count of users is what keeps us working on the project, because otherwise we have feel like we are coding into a void." So, they wrote code to phone home (by default) and then digging in and defen…

> So, they wrote code to phone home (by default) and then digging in and defending it... just for their feelings? You've got to be kidding me!

Is that better or worse than phoning home to serve ads?

Also, if feels misleading to me to call fetching a motd phoning home. You know Ubuntu does this too right? That feels more worthy of outrage than this.

If someone tells me, this software phones home, and it's not transmitting anything other than a ping; kinda feels like they're lying to me about what it's actually doing.

I'm not upset by the author wanting a bit of human connection to the people who enjoy his software. I empathize with the desire to see people enjoy the stuff I've made. Is it a privacy risk? Perhaps, but it's not even on the top 1k that I see daily. There's more important windmills to tilt at.

But... if you really just wanna be outraged; I recently wrote a DNS server that I use as the default for my home system. Currently It prints every request made, you might wanna try something like that. If you're that upset about this, you're gonna be blown away by what else is going on you didn't even know about.... and that's just dns queries, it's not even the telemetry getting sent!

Re: Why does Debian change software?

#180

Post by [deleted] »

ryandrake wrote: post #141
hedora wrote: post #112

Earlier quoted context omitted.

The maintainer’s responses in that thread are really frustrating. They just keep describing the bug as though the package’s behavior is acceptable. I wonder what debian’s process is for dealing with such maintainers. I hope they make “no phone home” actual policy soon.

Infuriating. The developer is just making excuses and refusing to address the users' actual concern. And why are they phoning home in the first place? What is this critical use case that requires this intrusion? "This daily count of users is what keeps us working on the project, because otherwise we have feel like we are coding into a void." So, they wrote code to phone home (by default) and then digging in and defen…

[deleted]
Post reply on HN