Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

161–170 of 210 posts

Re: Why does Debian change software?

#161

Post by kragen »

ak217 wrote: post #142
kragen wrote: post #79

Earlier quoted context omitted.

It was plausibly the worst computer security bug in human history, but by the same token, it's hard to see it as indicating a systemic problem with either Debian or OpenSSL. When we're dealing with a once-in-history event like that, where it happens is pretty random. It's the problem of inference from a small sample.

I think it's important to learn from incidents. It's clear there were design issues on both projects' sides that allowed that bug to happen, and in fact several of them were fixed in subsequent years (though not quickly, and not until major corporate sponsors got concerned about OpenSSL's maintenance).

I agree, but it's not clear that there aren't worse design issues in the alternatives.

Re: Why does Debian change software?

#162

Post by karambahh »

s_ting765 wrote: post #133
spookie wrote: post #57

Earlier quoted context omitted.

Arch is a minefield on this regard tbh

Arch has been bliss for me. I'm heavy on Flatpaks and primarily use Arch as a base operating system with very minimal config changes.

I'm on the market for a decent laptop. Don't want to side-line the thread, but is Arch supported decently on, say, Dell or any "enterprise grade" laptops?

Re: Why does Debian change software?

#163

Post by yjftsjthsd-h »

arp242 wrote: post #138
capitol_ wrote: post #51

Earlier quoted context omitted.

It's also easy for people to have the opinion the those who do the unpaid work of packaging software should do even more work for free. I have sent about 50 or so patches upstream for the 300 packages I maintain and while it reduces the amount of work long-term it's also surprisingly amount of work. Typically the Debian patches are licensed under the same license as the original project. So there is nothing stopping…

I didn't ask for you to second-guess my software. I didn't ask you to ship modified (potentially broken and/or substantially different in opinionated ways) versions of my software under the same name. If you're going to do that, then you should actually let people know. Otherwise don't do it. It's not about "but the license allows it", it's about what the right thing to do is. Debian has given me the most grief of an…

> If you're going to do that, then you should actually let people know. Otherwise don't do it. It's not about "but the license allows it", it's about what the right thing to do is.

Okay, I am hereby letting you know: Every single distro patches software. All of them. Debian, Arch, Fedora, Gentoo, NixOS, Alpine, Void, big, small, commercial, hobbyist. All of them.

Re: Why does Debian change software?

#164

Post by diggan »

gus_ wrote: post #134
exiguus wrote: post #73

Earlier quoted context omitted.

Most good stuffed Distros do this. For example SUSE recently banned a package because of "calling home" e.g. did side-leading. https://security.opensuse.org/2025/05/07/deepin-desktop-remo... Debian indeed does this. In release FF has disabled telemetry: https://wiki.debian.org/Firefox

Unfortunately that is not entirely true. For example, when closing firefox on OpenSUSE Leap 15.6, "pingsender" is launched to collect telemetry: https://imgur.com/a/k3Nnbbj It has been there for years. It is also on other distros.

Did someone report/open a issue about it? Maybe it's as simple as them not being aware of it.

Re: Why does Debian change software?

#165

Post by yjftsjthsd-h »

vbezhenar wrote: post #78
Hackbraten wrote: post #74

Earlier quoted context omitted.

Why do you assume Debian packagers don’t do the same?

Because it's well known that debian packagers alter software they package with unnecessary patches.

Of course it's well known, but is it true?

Re: Why does Debian change software?

#166

Post by LtWorf »

binaryturtle wrote: post #137
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

Why can't I get GNOME stop calling home? (on a Debian installation) Each time I fire up my Debian VM with GNOME here on my OSX host system Little Snitch pops up because some weird connection to a GNOME web endpoint. One major pet peeve of mine.

You can ask the gnome team if they'd accept a patch. They might be of the idea that patching stuff out is bad.

Re: Why does Debian change software?

#167

Post by mos_basik »

karambahh wrote: post #162
s_ting765 wrote: post #133

Earlier quoted context omitted.

Arch has been bliss for me. I'm heavy on Flatpaks and primarily use Arch as a base operating system with very minimal config changes.

I'm on the market for a decent laptop. Don't want to side-line the thread, but is Arch supported decently on, say, Dell or any "enterprise grade" laptops?

Short answer to a pretty broad question: Yes

More color: I was happy running Arch on a 2012 vintage Dell Latitude (Intel, integrated graphics) for several years. I'm currently quite happy running Arch on a Lenovo Thinkpad T14s (gen2, AMD, integrated graphics).

Arch wiki does have many pages about arch-on-a-particular-model to help once you get a short list of models you're interested in, like this: https://wiki.archlinux.org/title/Lenovo_ThinkPad_T14s_(AMD)_...

Re: Why does Debian change software?

#168

Post by skydhash »

karambahh wrote: post #162
s_ting765 wrote: post #133

Earlier quoted context omitted.

Arch has been bliss for me. I'm heavy on Flatpaks and primarily use Arch as a base operating system with very minimal config changes.

I'm on the market for a decent laptop. Don't want to side-line the thread, but is Arch supported decently on, say, Dell or any "enterprise grade" laptops?

I haven’t tried much, but as long as you avoid nvidia or fancy laptops with weird components, you will be good. My recommendation is to go for business line, as they have more standardized peripherals. Better if there’s some linux support guarantee.

Re: Why does Debian change software?

#169

Post by overfeed »

bityard wrote: post #153
rmccue wrote: post #97

Earlier quoted context omitted.

The library I was maintaining (SimplePie) was an RSS feed parser which supported every flavour of the RSS/Atom specs. Because of the history of those particular formats, there were a huge number of compatibility hacks necessary to parse real-world data, and cases where the "spec" (actually just a vague page on a website) was inaccurate compared to actual usage. This was a while ago (10+ years), but my recollection is…

First I want to say that I love Debian. They have a great distro that is simple and quite frankly a joy to use, and manage to keep it all going on basically nothing but volunteer effort. However, I do believe that in certain areas, they give too much freedom to package maintainers. The bar for being a package maintainer in Debian is relatively low, but once a package _has_ a maintainer--and barring any actual Debian…

> The bar for being a package maintainer in Debian is relatively low

It's typically an unglamorous, demanding, unpaid, volunteer position a few rungs above volunteering at a soup kitchen or food bank. It's unsurprising that the bar is low.

It's also trivial for upstream maintainers to set up their own competing Debian package repos that entirely ignore Debian rules - Microsoft has one for VS Code.

Re: Why does Debian change software?

#170

Post by LtWorf »

deng wrote: post #151
dsr_ wrote: post #126

Earlier quoted context omitted.

The ongoing problem with popcon is that it's known not to be accurate, but since it's the data that's available, people make decisions based on it. popcon is least likely to be turned on by: - organizations with any kind of sensible privacy policy (which includes almost everyone running more than a handful of machines) - individuals concerned about privacy popcon is most likely to be turned on by Debian developers, a…

Yeah, isn't that a shame? Wouldn't it be nice if instead of catastrophizing that telemetry data is always only ever there to spy on us, that we might assume that there are actually trustworthy projects out there? Especially for FOSS projects, which can usually not afford extensive in-house user testing, telemetry provides extremely valuable data to see how their software is used and where it can be improved, especial…

Turning it on and being unable to turn it off aren't the same.
Post reply on HN