Live data from Hacker News

Why does Debian change software?

blog.liw.fi

11–20 of 210 posts

Re: Why does Debian change software?

#11
post #3

But what does Debian see as the risks of patching the software they distribute and how do they mitigate them?

Debian isn't a single person. A lot of patches are backport fixes for CVEs.

Then there's stuff like: "this project only compiles with an obsolete version of gcc" so the alternatives are dropping it or fixing it. Closely related are bugs that only manifest on certain architectures, because the developers only use amd64 and never compile or run it on anything else, so they make incorrect assumptions.

Then there's python that drops standard library modules every release, breaking stuff. So they get packaged separately outside of python.

There's also cherry picking of bugfixes from projects that haven't released yet.

Is there any reason you think debian developers are genetically more prone to making mistakes than anyone else? Considering that debian has an intensive test setup that most projects don't even have.

Re: Why does Debian change software?

#12
post #3

But what does Debian see as the risks of patching the software they distribute and how do they mitigate them?

I mean, it would depend on what the patch is? If you're adding a missing manpage, I'm not sure what can go wrong? Is changing the build options (e.g. enabling or disabling features) a patch, or an expected change (and if such a config option is bad, what blame should be put on upstream for providing it)? What about default config files (which could both make the software more secure or less, such as what cyphers to use with TLS or SSH)?

Re: Why does Debian change software?

#13
post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This policy is missing from nixpkgs, although there is a similar policy for the build process for technical reasons.

So I can add spotify or signal-desktop to NixOS via nixpkgs, and they won’t succeed at updating themselves. But they might try, which would be a violation of Debian’s guidelines.

It’s a tough line — I like modern, commercial software that depends on some service architecture. And I can be sure it will be sort of broken in 10-15 years because the company went bust or changed the terms of using their service. So I appreciate the principles upheld by less easily excited people who care about the long term health of the package system.

Re: Why does Debian change software?

#14
post #7
post #6

Earlier quoted context omitted.

It's not guaranteed that they manage to catch all the software that does this though :D

Any such leftover behavior is going to be a reportable and fixable bug then.

I'm not sure it's explicitly in the policy or if any team can decide what to do…

Re: Why does Debian change software?

#15
post #8

Earlier quoted context omitted.

Do you have any statistics that show that Debian patches introduce more CVE worthy bugs than the software already contains? OpenSSL doesn't really have a pristine history. Let's not forget that the patch had been posted on the OpenSSL mailing list and had received a go ahead comment before that. Having said that, if you're asking if there's a penetration test team that reviews all the patches. No there isn't. Like th…

That was the kind of answer I wanted to hear, thanks. (Of course I don't think Debian should be blamed for incidents.) Does Debian send other patches as well? For example, I didn't know that Debian also often creates a man page by its own.

If you go to https://tracker.debian.org/ for any package, it lists patches that need to be sent upstream.

Re: Why does Debian change software?

#16
The point about manual pages has always seemed to me to be one of the points where the system fails us. There are a fair number of manual pages that the world at large would benefit from having in the original softwares, that are instead stuck buried in a patches subdirectory in a Debian git repository, and have been for years.

This is not to say that Debian is the sole example of this. The FreeBSD/NetBSD packages/ports systems have their share of globally useful stuff that is squirrelled away as a local patch. The point is not that Debian is a problem, but that it too systematizes the idea that (specifically) manual pages for external stuff go primarily into an operating system's own source control, instead of that being the last resort.

Re: Why does Debian change software?

#17
This is one of the reasons I switched to RHEL 10+ years ago.

I actually prefer the RHEL policy of leaving packages the way upstream packaged them, it means upstream docs are more accurate, I don't have to learn how my OS moves things around.

One example that sticks out in memory is postgres, RHEL made no attempt to link its binaries into PATH, I can do that myself with ansible.

Another annoying example that sticks out in Debian was how they create admin accounts in mysql, or how apt replaces one server software with another just because they both use the same port.

I want more control over what happens, Debian takes away control and attempts to think for me which is not appreciated in server context.

It swings both ways too, right now Fedora is annoying me with its nano-default-editor package. Meaning I have to first uninstall this meta package and then install vim, or it'll be a package conflict. Don't try and think for me what editor I want to use.

Re: Why does Debian change software?

#18

Earlier quoted context omitted.

That was the kind of answer I wanted to hear, thanks. (Of course I don't think Debian should be blamed for incidents.) Does Debian send other patches as well? For example, I didn't know that Debian also often creates a man page by its own.

If you go to https://tracker.debian.org/ for any package, it lists patches that need to be sent upstream.

Ah, I meant more about policies and guidelines. I'm not well-versed in Debian processes so I can for example imagine that only some patches get sent to the upstream only at the maintainers' discretion. It seems that Debian at least has a policy to maintain patches separate from the upstream source though.

Re: Why does Debian change software?

#19

This is one of the reasons I switched to RHEL 10+ years ago. I actually prefer the RHEL policy of leaving packages the way upstream packaged them, it means upstream docs are more accurate, I don't have to learn how my OS moves things around. One example that sticks out in memory is postgres, RHEL made no attempt to link its binaries into PATH, I can do that myself with ansible. Another annoying example that sticks ou…

"I actually prefer the RHEL policy of leaving packages the way upstream packaged them"

Are you kidding now? Red Hat was always notorious of patching their packages heavily, just look download an SRPM and have a look.

Re: Why does Debian change software?

#20
post #16

The point about manual pages has always seemed to me to be one of the points where the system fails us. There are a fair number of manual pages that the world at large would benefit from having in the original softwares, that are instead stuck buried in a patches subdirectory in a Debian git repository, and have been for years. This is not to say that Debian is the sole example of this. The FreeBSD/NetBSD packages/po…

That only happens if the project lacks a manual page or if it's really bad.
Post reply on HN