Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

191–200 of 210 posts

Re: Why does Debian change software?

#191

Post by LtWorf »

arp242 wrote: post #175
yjftsjthsd-h wrote: post #163

Earlier quoted context omitted.

> If you're going to do that, then you should actually let people know. Otherwise don't do it. It's not about "but the license allows it", it's about what the right thing to do is. Okay, I am hereby letting you know: Every single distro patches software. All of them. Debian, Arch, Fedora, Gentoo, NixOS, Alpine, Void, big, small, commercial, hobbyist. All of them.

That's simply not true. Some distros may patch a few build issues, or maybe the rare breaking bug, but nothing like what Debian does. To claim anything else is Trumpian levels of falsehood.

What does debian do exactly?

Re: Why does Debian change software?

#192

Post by esperent »

mschuster91 wrote: post #187
esperent wrote: post #185

Earlier quoted context omitted.

> The testicle speaks for itself It really doesn't. It says he hates users from HN but it says nothing about why . Is it really just that he doesn't like the traffic? If it's because he has a grudge against VCs, which is more understandable, why is he taking it out on HN users ?

> If it's because he has a grudge against VCs, which is more understandable, why is he taking it out on HN users? It's a small form of protest. Make people uncomfortable.

What's the point in protesting if nobody witnessing your protest has any idea what you're protesting?

Re: Why does Debian change software?

#193

Post by sshine »

jchw wrote: post #110
sshine wrote: post #13

Earlier quoted context omitted.

This policy is missing from nixpkgs, although there is a similar policy for the build process for technical reasons. So I can add spotify or signal-desktop to NixOS via nixpkgs, and they won’t succeed at updating themselves. But they might try, which would be a violation of Debian’s guidelines. It’s a tough line — I like modern, commercial software that depends on some service architecture. And I can be sure it will…

To be fair, we (Nixpkgs maintainers) do remove or disable features that phone home sometimes even though it's not policy. That said, it would be nice if it was policy. Definitely was discussed before (most recently after the devbox thing I guess.)

Discord downloads stuff every single time I start it. So there is definitely not a policy to remove this behaviour.

And yes, good point, this was indeed discussed when devbox enabled AI training by default. It somehow seems like there is more than one category of phoning home at play here, since it is obviously tolerated in other cases.

Re: Why does Debian change software?

#195

Post by guappa »

JdeBP wrote: post #41
guappa wrote: post #20

Earlier quoted context omitted.

That only happens if the project lacks a manual page or if it's really bad.

"only happens" is a lot more often that you think. In my experience, "only" is quite frequent. A randomly picked case in point: Debian has had a local manual page for the original software's undocumented (in the old Sourceforge version) iptunnel(8) command for 7 years: https://salsa.debian.org/debian/net-tools/-/blob/debian/sid/... Independently, the original came up with its own, quite different, manual page 3 years…

Wow 1 instance. Ok. World ending.

Re: Why does Debian change software?

#196

Post by gspr »

Barrin92 wrote: post #159
gspr wrote: post #64

Earlier quoted context omitted.

Since this is the FOSS world, you are of course free to eschew distributions. But: > it's effectively nothing but the "app store" model, having an activist distributor insert themselves between the user and software. is just factually wrong. Distributions like Debian try to make a coherent operating system from tens of thousands of pieces of independently developed software. It's fine not to like that. It's fine to i…

>But a distribution is neither an "app store", nor does it "insert itself" between the user and the software. Just scroll up to the second comment in the thread right now by the user rmccue . Given that Debian doesn't give the user any indication of the fact that it even has modified an upstream piece of software it's obviously perfectly possible for them to insert themselves without you even knowing it. And in that…

> Given that Debian doesn't give the user any indication of the fact that it even has modified an upstream piece of software

Debian also doesn't give any indication that we haven't modified an upstream piece of software. Modifying software is a central thing to do in the FOSS world. If the user wants to know if anything was was modified, and if so what, then the source is of course freely available.

> it's obviously perfectly possible for them to insert themselves without you even knowing it.

They didn't "insert themselves" anywhere! You, the user, inserted Debian!

> And in that case, according to the developer, even introduced subtle bugs.

Of course, any software modification can introduce, alter or fix bugs. Or all three.

> So you can run buggy software as a consequence of some maintainer thinking they know more than a developer

That can happen. And sometimes you run less buggy software as a consequence of "some maintainer" knowing more about the system as a whole than the software's original developer. Or caring more about safeguarding the user's freedoms or privacy.

> and not even know it because you have no practical info about that process.

"Practical info"? What exactly would you like, beyond a changelog and the the source?

> This is of course not a "choice" in any meaningful sense of the term.

Of course! You chose to run Debian. Debian is entirely upfront about this!

> Nobody ever actually wants to use a buggy php library maintained by debian over a functioning one maintained a by developer

I can't speak for PHP myself, I don't use it at all, but I'm almost always extremely grateful to the maintainers of the packages on my Debian systems for the (often very tiresome!) work they do in adapting upstream software to fit Debian Policy and the Debian Social Contract. (Disclaimer: I am a DD myself.)

> they very likely just never even were aware that that is what they were served.

Would it help if the Debian install guide hade a note saying "be aware that a Debian package may not be exactly the same was what was shipped by the software's original developers – Debian aims to build a coherent universal operating system centered around our Social Contract and Policy"?

Re: Why does Debian change software?

#197

Post by aragilar »

nullc wrote: post #136
aragilar wrote: post #9

Earlier quoted context omitted.

https://research.swtch.com/openssl provides more context: openssl was asked about the change, and seemingly approved it (whether everyone understood what was being approved is a different question). It's not clear why openssl never adopted the patch (was everyone else just lucky?), but I wonder what the reaction would have been if the patch had been applied (or the lines hidden away by a build switch).

> It's not clear why openssl never adopted the patch OpenSSL already had an option to safely disable the bad behavior, -DPURIFY.

In one of two cases I believe? I wonder what would have happened if both calls ended up being wrapped, if the bug would have taken even longer than it did to be found...

Re: Why does Debian change software?

#198

Post by LtWorf »

yjftsjthsd-h wrote: post #165
vbezhenar wrote: post #78

Earlier quoted context omitted.

Because it's well known that debian packagers alter software they package with unnecessary patches.

Of course it's well known, but is it true?

On r/linux it's well known that Qt is not free software. It's that kind of information that gets passed down generation to generation although no longer being relevant.

Re: Why does Debian change software?

#199

Post by WHA8m »

spookie wrote: post #57
diggan wrote: post #55

Earlier quoted context omitted.

Yeah, NixOS for all servers (homelab + dedicated remote ones) and Arch on desktop.

Arch is a minefield on this regard tbh

Hey, I might be too late to the party, but I'd love to get some more info to your comment.

Imagine me: I'd consider myself a Linux noob, although I probably aren't anymore. I use Arch Linux for about 3 years now as my daily driver. I'm not young anymore - I didn't grew up with computers - I don't have it in my blood. I don't have formal education in anything computer and have never worked in the field. During Covid I learnt Linux from the Arch wiki. Now I'm using it. I configured some things and can control my computer through the command line.

Everytime I read comments like yours, I get the shivers. Did I miss something integral? What do I not know about? Especially network stuff is a blind spot for me. I didn't touch network stuff beyond the default wiki pages.

When I read comments like yours "Arch is a minefield" "With Arch it is so easy to shoot yourself in the foot", I never know what this could be specifically. How could this look like? Can you give me something more concrete? I'm really eager to know what everyone is talking about.

Re: Why does Debian change software?

#200

Post by WHA8m »

lukan wrote: post #104
moffkalast wrote: post #89

Earlier quoted context omitted.

Windows is also what you make it with enough registry hacks, I'm not recommending it to anyone though.

Well, but windows comes with spyware by default and tries to activly keep it that way. A registry hack might stop working anytime. Windows is activly hostile to anything privacy related. Arch comes with the default of do it yourself. Lots of footguns, but not hostile OS behavior. Great difference to me.

This is a duplicate command to increase my chance of getting a late reply :) Hope that's fine.

When I read comments like yours "Arch is a minefield" "With Arch it is so easy to shoot yourself in the foot", I never know what this could be specifically. How could this look like? Can you give me something more concrete? I'm really eager to know what everyone is talking about.

Imagine me: I'd consider myself a Linux noob, although I probably aren't anymore. I use Arch Linux for about 3 years now as my daily driver. I'm not young anymore - I didn't grew up with computers - I don't have it in my blood. I don't have formal education in anything computer and have never worked in the field. During Covid I learnt Linux from the Arch wiki. Now I'm using it. I configured some things and can control my computer through the command line.

Everytime I read comments like yours, I get the shivers. Did I miss something integral? What do I not know about? Especially network stuff is a blind spot for me. I didn't touch network stuff beyond the default wiki pages.

Post reply on HN