Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

111–120 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#111

Post by thaumaturgy »

barbariangrunge wrote: post #92
thaumaturgy wrote: post #62

Earlier quoted context omitted.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive.

I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it.

Package maintainers aren't self-sacrificial saints or all that unique as volunteers go.

This is a bad decision. It deserves criticism and discussion. The volunteer status of package maintainership is irrelevant.

Re: KeePassXC Debian maintainer has removed all network features

#112

Post by riedel »

cjk2 wrote: post #82
worble wrote: post #79

Earlier quoted context omitted.

Well no, what the user is actually being given is a completely different application than the original one they downloaded, which is now increasing the maintenance burden upstream because THEY are they one getting all the bug reports because Debian decided to swap the packages out from underneath their users: https://github.com/keepassxreboot/keepassxc/issues/10725#iss... > This is now our fourth bug report because o…

It's not completely different. They patched stuff out. And I, as an end user, am absolutely fine with that, as a user of vim-nox package etc etc...

I thought from reading the bug report is that they only changed the default of a supported cmake build flag. I think that a keepass-nonet would have be a wiser choice, but I do not blame Debian people to be opinionated towards the more secure choice.

Re: KeePassXC Debian maintainer has removed all network features

#113

Post by 0x_rs »

I would like to believe package maintainers should operate under a principle of least astonishment and not disable core features (and not plugins, despite currently 25 entries of that word in this comment section) unless there's a documented or at the very least probable risk, none of which seem to be the case here. KeePassXC has many features but none that would on their own, and without explicit user intervention, be a likely source of vulnerabilities. The browser integration must be toggled on before you can even set it up, likewise for (I believe) every other function disabled with this flag, so a -minimal package may have been more appropriate. The small subset of users that could benefit in some indeterminate future from this change must be incredibly small, while it's going to be a serious annoyance for anyone using the browser integration, a function that's generally far safer than clipboard access. It also doesn't feel in line with the project's vision:

Our goal is to create an application that can be used by anyone while still offering advanced features to those that need them.

Re: KeePassXC Debian maintainer has removed all network features

#114

Post by [deleted] »

barbariangrunge wrote: post #92
thaumaturgy wrote: post #62

Earlier quoted context omitted.

If both upstream and a significant portion of users strongly disagree with a maintainer's judgement, then how is their role as maintainer justified? It's KeePassXC's job to secure the software and produce features that fulfill users' needs as they see fit. Julian's role as maintainer may intersect with that to a limited extent , in deciding on what kind of defaults best fit the rest of the OS. But, in this case, the…

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

[deleted]

Re: KeePassXC Debian maintainer has removed all network features

#115

Post by cjk2 »

alyandon wrote: post #108
cjk2 wrote: post #82

Earlier quoted context omitted.

It's not completely different. They patched stuff out. And I, as an end user, am absolutely fine with that, as a user of vim-nox package etc etc...

vim-nox is pretty much full-featured vim without x11 stuff. Do you have a non-trivial .vimrc/.vim directory? Would you be accepting of the maintainer disabling a bunch of features and pushing those changes out under the main vim-nox package such that it breaks your existing install? Would it be reasonable to expect you as the end user to figure out what has happened and that you need to uninstall vim-nox and and inst…

My .vimrc is 8 lines. I learned not take the kitchen sink with me on holiday.

Re: KeePassXC Debian maintainer has removed all network features

#116

Post by lupusreal »

nulld3v wrote: post #19
lupusreal wrote: post #18

Earlier quoted context omitted.

[flagged]

They removed other non-networking features too. E.g. even autotype was removed. At that point why not just store your passwords in an encrypted notes app?

I use KeePassXC, but not any network features or autotyping, because I like the password generation and because the interface is nice. I previously used Vim's old encryption feature (since removed I think?) and I think KeePassXC as I use it is a good upgrade from that.

Re: KeePassXC Debian maintainer has removed all network features

#117

Post by JeremyNT »

dannyw wrote: post #52
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

The role of a maintainer is more than copying and pasting upstream. They are allowed to exercise their judgement in what they believe is appropriate for end users of a distribution. In this case, there does seem to be reasonable security justifications for it, and an alternative is provided.

Maybe Debian maintainers consider it their role to do this, but that's absolutely not true in other distributions (e.g., one reason I use Arch is to avoid such tinkering). Down this road lies problems with incompatibilities and new bugs that are distro-specific.

As a user it defies my expectations to have software modified to remove functionality and retain the same name. This is a bit too opinionated for my tastes.

Re: KeePassXC Debian maintainer has removed all network features

#118

Post by g1sm »

Kwpolska wrote: post #96
barbariangrunge wrote: post #92

Earlier quoted context omitted.

Sorry, why do maintainers owe us anything? They’re typically unpaid or poorly paid and are doing everyone a favour. The code is open source and anyone who doesn’t like their work can easily fork the project. They don’t need to justify anything to us

This isn’t the project maintainer we’re talking about, it’s the Debian package maintainer. Their job is building a working .deb with working software, not randomly messing with it. Users have the right to demand their packages to be trustworthy.

He wasn’t randomly messing with it, there was a bug report about this:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529

Re: KeePassXC Debian maintainer has removed all network features

#119

Post by JeremyNT »

Arnavion wrote: post #29
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

There's one way in which browser integration improves security vs not using it, which is that the browser extension checks the page URL before filling in the credentials, while the approach of manually copy-pasting credentials is vulnerable to typo- and homoglyph-phishing.

This is essential to my own usage of KeepassXC. I never copy/paste from it into a browser and appreciate having this first line defense against phishing.

Re: KeePassXC Debian maintainer has removed all network features

#120

Post by Kwpolska »

g1sm wrote: post #118
Kwpolska wrote: post #96

Earlier quoted context omitted.

This isn’t the project maintainer we’re talking about, it’s the Debian package maintainer. Their job is building a working .deb with working software, not randomly messing with it. Users have the right to demand their packages to be trustworthy.

He wasn’t randomly messing with it, there was a bug report about this: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529

Doing it in response to a single user’s bug report from 2020 that does not provide any rationale other than “network access bad” constitutes randomly messing with packages.
Post reply on HN