Why does Debian change software? • Hacker News Board

Re: Why does Debian change software?

#111

Post by officeplant » Thu, May 22, 2025, 1:38 PM UTC

BarbaryCoast wrote: post #107

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a…

Long time Debian fan, current Devuan user. I'm sure it still has it's problems, but it feels nice and stable, especially on older hardware that is struggling with the times. (Thinkpad R61i w/core2duo T8100 swapped in and middleton bios)

Re: Why does Debian change software?

#112

Post by hedora » Thu, May 22, 2025, 1:41 PM UTC

vaporary wrote: post #56

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

I was extremely disappointed to recently learn that visidata(1) phones home, and that this functionality has not been disabled in the Debian package, despite many people requesting its removal: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001647 https://github.com/saulpw/visidata/discussions/940

The maintainer’s responses in that thread are really frustrating. They just keep describing the bug as though the package’s behavior is acceptable.

I wonder what debian’s process is for dealing with such maintainers.

I hope they make “no phone home” actual policy soon.

Re: Why does Debian change software?

#113

Post by dgb23 » Thu, May 22, 2025, 1:42 PM UTC

rmccue wrote: post #97

diggan wrote: post #93

Earlier quoted context omitted.

> it fucking sucked that they made source modifications As a maintainer, I can certainly understand how it feels like that, I'd probably wouldn't feel great about it either. As a user, I'm curious what kind of modifications they felt were needed, what exactly did they change in your library?

The library I was maintaining (SimplePie) was an RSS feed parser which supported every flavour of the RSS/Atom specs. Because of the history of those particular formats, there were a huge number of compatibility hacks necessary to parse real-world data, and cases where the "spec" (actually just a vague page on a website) was inaccurate compared to actual usage. This was a while ago (10+ years), but my recollection is…

That sounds very careless. Not only does this break an obviously deliberate feature, it also violates the robustness principle. Whether one likes it or not, it’s a guiding principle for the web. Most importantly this „fix“ was bad for its users.

Good intentions, but unfortunately bad outcome.

There was a somewhat recent discussion on here on how OS projects on GitHub are pestered by reports as well. Some athors commented that it even took away their motivation to publish code.

It’s always the same mechanism isn’t it. The „why we can’t have nice things“ issue. Making everything at least slightly worse, because there are people who exploit a system or trust based relationship.

Re: Why does Debian change software?

#114

Post by beerandt » Thu, May 22, 2025, 1:43 PM UTC

lqet wrote: post #59

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

One of the many reasons I switched from Ubuntu to Debian 2 years ago. Another reason was snap.

Between snap and having completely different network implementations between "desktop" and "server" versions really made me fall back down the learning curve of nix.

Especially since I was novice at best before the systemd thing, and my Ubuntu dive involved trying to navigate all 3 of these pretty drastic changes at once (oh yea and throw containers on top of that).

I went into it with the expectation that it was going to piss me off, and boy did it easily exceeded that threshold.

Re: Why does Debian change software?

#115

Post by hedora » Thu, May 22, 2025, 1:43 PM UTC

master_crab wrote: post #62

lqet wrote: post #59

Earlier quoted context omitted.

One of the many reasons I switched from Ubuntu to Debian 2 years ago. Another reason was snap.

Yup. Snap is emblematic of all the complexity Canonical bakes into Ubuntu.

That and the whole systemd stack. Canonical employees had enough votes to force upstream it into debian.

I switched to devuan. It’s great, but it sucks that the community split over something so needlessly destructive.

Re: Why does Debian change software?

#116

Post by deng » Thu, May 22, 2025, 1:46 PM UTC

enfuse wrote: post #109

deng wrote: post #69

Earlier quoted context omitted.

No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…

> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry, so there's no need for a fork. This changed somewhat recently. Telemetry is enabled by default (I think as of Golang 1.23?) I am only aware since I relatively recently ran into something similar to this on a fresh VM without internet egress: https://github.com/golang/go/issues/68976 https:…

It creates telemetry data, but actually transmitting it is opt-in.

Re: Why does Debian change software?

#117

Post by hedora » Thu, May 22, 2025, 1:49 PM UTC

t312227 wrote: post #92

lifthrasiir wrote: post #5

The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...

hello, as always: imho (!) i remember this incident - if my memory doesn't trick me: it was openssl which accessed memory it didn't allocated to collect randomness / entropy for key-generation. and valgrind complained about a possible memory-leak - its a profiling-tool with the focus on detecting memory-mgmt problems. * https://valgrind.org/ instead of taking a closer look / trying to understand what exactly went on…

But why patch it in debian, and not file an upstream bug?

It’s doubly important to upstream issues for security libraries: There are numerous examples of bad actors intentionally sabotaging crypto implementations. They always make it look like an honest mistake.

For all we know, prior or future debian maintainers of that package are working for some three letter agency. Such changes should be against debian policy.

Re: Why does Debian change software?

#118

Post by kevin_thibedeau » Thu, May 22, 2025, 1:51 PM UTC

diggan wrote: post #87

RetroTechie wrote: post #84

Earlier quoted context omitted.

> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition . It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort…

> Telemetry contains personal data by definition Why it has to include PII by definition ? I'd say DNF Counting ( https://github.com/fedora-infra/mirrors-countme ) should be considered "telemetry", yet it doesn't seem to collect any personal data, at least by what I understand telemetry and personal data to mean. I'm guessing that you'd either have to be able to argue that DNF Counting isn't telemetry, or that it con…

IPs are PII. You hit the server, and your anonymity is breached.

Re: Why does Debian change software?

#119

Post by enfuse » Thu, May 22, 2025, 1:51 PM UTC

deng wrote: post #116

enfuse wrote: post #109

Earlier quoted context omitted.

> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry, so there's no need for a fork. This changed somewhat recently. Telemetry is enabled by default (I think as of Golang 1.23?) I am only aware since I relatively recently ran into something similar to this on a fresh VM without internet egress: https://github.com/golang/go/issues/68976 https:…

It creates telemetry data, but actually transmitting it is opt-in.

Attempts to contact external telemetry servers under default configuration is the issue. That not all of the needlessly locally aggregated data would actually be transmitted is separate.

Re: Why does Debian change software?

#120

Post by bayindirh » Thu, May 22, 2025, 1:52 PM UTC

BarbaryCoast wrote: post #107

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a…

> Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox.

No, it's not. Stable ships ESR which has its update mechanism is disabled. Same for Testing/Unstable. It follows standard releases, but autoupdate is disabled.

Even Official Firefox Package for Debian from Mozilla has its auto-updates disabled and you get updates from the repository.

Only auto-updating version is the .tar.gz version which you extract to your home folder.

This is plain FUD.

Moreover:

Debian doesn't ship pulseaudio anymore. It's pipewire since forever. Many people didn't notice this, it was that smooth. Ubuntu's changes are not allowed to permeate without proper rigor (I follow debian-devel), and it's still released when it's ready. Ubuntu follows Debian Unstable, and Unstable suite is a rolling release, and they can snapshot it and start working on it whenever they want.

I'm using Debian since version 3 too, and I still reboot or tend my system only at kernel changes. It's way snappier w.r.t. Ubuntu with the same configuration for the same tasks, and is the Debian we all know and like (maybe sans systemd. I'll not open that can of worms).