Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

181–190 of 210 posts

Re: Why does Debian change software?

#181

Post by Eavolution »

karambahh wrote: post #162
s_ting765 wrote: post #133

Earlier quoted context omitted.

Arch has been bliss for me. I'm heavy on Flatpaks and primarily use Arch as a base operating system with very minimal config changes.

I'm on the market for a decent laptop. Don't want to side-line the thread, but is Arch supported decently on, say, Dell or any "enterprise grade" laptops?

I have a Dell Vostro 7620 currently running Arch. Even with the Nvidia graphics card I have run into very few issues (only once did a nvidia driver update did break the system), so I'd say go for it.

Re: Why does Debian change software?

#182

Post by redeeman »

bayindirh wrote: post #120
BarbaryCoast wrote: post #107

Earlier quoted context omitted.

This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a…

> Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. No, it's not. Stable ships ESR which has its update mechanism is disabled. Same for Testing/Unstable. It follows standard releases, but autoupdate is disabled. Even Official Firefox Package for Debian from Mozilla has its auto-updates disabled and you get updates from the…

pulseaudio is default for atleast kde desktop in current debian stable. Trixie might change that, but its not official release yet

Re: Why does Debian change software?

#183

Post by lmm »

SAI_Peregrinus wrote: post #157
lmm wrote: post #128

Earlier quoted context omitted.

> On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself. No it wasn't. It was reading (and xoring into the randomness that would become the key being generated) uninitialised char values from an array whose address was taken, t…

I see you're correct, I misremembered. That isn't really much better, since there's no requirement that unspecified values ever actually change. Compiler developers are free to always return `0x00` when reading any unspecified `char` value, which wouldn't provide any entropy. XORing it in guaranteed that it couldn't subtract entropy, but if there were no other entropy sources they failed to return an error. OpenSSL b…

> XORing it in guaranteed that it couldn't subtract entropy, but if there were no other entropy sources they failed to return an error.

No, they XORed data from a bunch of entropy sources into an intermediate buffer (that was never initialised, because the whole point of it was to be random) and then XORed that into a buffer from which the key was made. Debian's patch removed that final XOR. It wasn't a bug in the original code (other than being hard to understand).

Re: Why does Debian change software?

#184

Post by lmm »

LtWorf wrote: post #172
lmm wrote: post #128

Earlier quoted context omitted.

> On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself. No it wasn't. It was reading (and xoring into the randomness that would become the key being generated) uninitialised char values from an array whose address was taken, t…

Current kernels zero pages. The code was buggy to begin with.

No, there was no bug. The code used an uninitialised array as a place to XOR randomness from various sources into. It didn't initialise the array since there was no value in doing so, because the whole point is to be random anyway.

Re: Why does Debian change software?

#185

Post by esperent »

mschuster91 wrote: post #127
esperent wrote: post #102

Earlier quoted context omitted.

> Always remember to not link to his site from HN because you'll get a testicle NSFW image What's his reason for targeting HN users this way?

The testicle speaks for itself [1]. He has held a serious political grudge against VC way over a decade back [2], the earliest mention of the JWZ testicles appearing on HN that I could find is over 9 years old [3]. [1] NSFW https://imgur.com/32R3qLv [2] (Redirects to NSFW, so open in incognito or you'll get the testicles) https://www.jwz.org/blog/2011/11/watch-a-vc-use-my-name-to-s... [3] https://news.ycombinator.com…

> The testicle speaks for itself

It really doesn't. It says he hates users from HN but it says nothing about why. Is it really just that he doesn't like the traffic?

If it's because he has a grudge against VCs, which is more understandable, why is he taking it out on HN users?

Re: Why does Debian change software?

#186

Post by LtWorf »

lmm wrote: post #184
LtWorf wrote: post #172

Earlier quoted context omitted.

Current kernels zero pages. The code was buggy to begin with.

No, there was no bug. The code used an uninitialised array as a place to XOR randomness from various sources into. It didn't initialise the array since there was no value in doing so, because the whole point is to be random anyway.

As I said, new kernels zero the pages, an uninitialized area is likely to be zeroed or be rather deterministic.

Re: Why does Debian change software?

#187

Post by mschuster91 »

esperent wrote: post #185
mschuster91 wrote: post #127

Earlier quoted context omitted.

The testicle speaks for itself [1]. He has held a serious political grudge against VC way over a decade back [2], the earliest mention of the JWZ testicles appearing on HN that I could find is over 9 years old [3]. [1] NSFW https://imgur.com/32R3qLv [2] (Redirects to NSFW, so open in incognito or you'll get the testicles) https://www.jwz.org/blog/2011/11/watch-a-vc-use-my-name-to-s... [3] https://news.ycombinator.com…

> The testicle speaks for itself It really doesn't. It says he hates users from HN but it says nothing about why . Is it really just that he doesn't like the traffic? If it's because he has a grudge against VCs, which is more understandable, why is he taking it out on HN users ?

> If it's because he has a grudge against VCs, which is more understandable, why is he taking it out on HN users?

It's a small form of protest. Make people uncomfortable.

Re: Why does Debian change software?

#188

Post by hsbauauvhabzb »

steeleduncan wrote: post #34
hsbauauvhabzb wrote: post #23

Do distro maintainers share patches, man pages, call home metrics and other data with other distros’ maintainers (and them back)? Further, do they publish any change information publicly?

> ... do they publish any change information publicly? This is utter FUD, of course they do, it is an open source distribution. Everything can be found from packages.debian.org

Sorry to clarify, I mean in a way that’s easily parseable. I’m not pulling down source files of every dev installed on my system to inspect raw .patch files and take the time to understand the differences.

You seem to be assuming malice in an innocent question though, that’s on you.

Re: Why does Debian change software?

#189

Post by lmm »

LtWorf wrote: post #186
lmm wrote: post #184

Earlier quoted context omitted.

No, there was no bug. The code used an uninitialised array as a place to XOR randomness from various sources into. It didn't initialise the array since there was no value in doing so, because the whole point is to be random anyway.

As I said, new kernels zero the pages, an uninitialized area is likely to be zeroed or be rather deterministic.

Which is fine. It's not a bug if it's zero. There's just no point going out of your way to set it to zero when you're only going to xor a bunch of random values into it anyway.

Re: Why does Debian change software?

#190

Post by commandersaki »

yjftsjthsd-h wrote: post #165
vbezhenar wrote: post #78

Earlier quoted context omitted.

Because it's well known that debian packagers alter software they package with unnecessary patches.

Of course it's well known, but is it true?

The fact that one piece of software can be split into more than one package, yes.
Post reply on HN