Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Debian change software?

blog.liw.fi

Post reply on HN
Print view View original

21–30 of 210 posts

Re: Why does Debian change software?

#21

Post by alias_neo »

BonusPlay wrote: post #2

Not the best name for the article. My first guess was version changes, or software being added/removed from repo. Turns out this is about source code modification.

As a native (British) English speaker, I was also unclear until reading the article.

Personally, I believe s/change/modify would make more sense, but that's just my opinion.

That aside, I'm a big fan of Debian, it has always "felt" quieter as a distro to me compared to others, which is something I care greatly about; and it's great to see that removing of calling home is a core principle.

All the more reason to have a more catchy/understandable title, because I believe the information in those short and sweet bullet points are quite impactful.

Re: Why does Debian change software?

#22

Post by guappa »

lifthrasiir wrote: post #18
aragilar wrote: post #15

Earlier quoted context omitted.

If you go to https://tracker.debian.org/ for any package, it lists patches that need to be sent upstream.

Ah, I meant more about policies and guidelines. I'm not well-versed in Debian processes so I can for example imagine that only some patches get sent to the upstream only at the maintainers' discretion. It seems that Debian at least has a policy to maintain patches separate from the upstream source though.

In theory you want all patches sent to upstream, but if they're for some specific debian reason then you can not send them.

Patches are maintained separately because debian doesn't normally repack the .tar.gz (or whatever) that the projects publish, as to not invalidate signatures and let people check that the file is in fact the same. An exception is done when the project publishes a file that contains files that cannot legally be redistributed.

Re: Why does Debian change software?

#24

Post by pabs3 »

TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This is unfortunately not part of Debian Policy yet, and there are still lots of privacy issues of different severities in Debian.

https://wiki.debian.org/PrivacyIssues

Re: Why does Debian change software?

#25

Post by pabs3 »

guappa wrote: post #14
phoe-krk wrote: post #7

Earlier quoted context omitted.

Any such leftover behavior is going to be a reportable and fixable bug then.

I'm not sure it's explicitly in the policy or if any team can decide what to do…

It isn't in policy yet no.

https://wiki.debian.org/PrivacyIssues

Re: Why does Debian change software?

#26

Post by mort96 »

sshine wrote: post #13
TekMol wrote: post #4

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.

This policy is missing from nixpkgs, although there is a similar policy for the build process for technical reasons. So I can add spotify or signal-desktop to NixOS via nixpkgs, and they won’t succeed at updating themselves. But they might try, which would be a violation of Debian’s guidelines. It’s a tough line — I like modern, commercial software that depends on some service architecture. And I can be sure it will…

In the process of trying to update, Spotify on NixOS will likely display some big error message about how it's unable to install updates, which results in a pretty bad user experience when everything is actually working as intended. It seems fair to patch software to remove such error messages.

Re: Why does Debian change software?

#27

Post by jeroenhd »

All of these reasons are good, but they're not comprehensive. Unless someone can tell me what category Debian's alterations to xscreensaver fall under, maybe. As far as I can tell, that was just done for aesthetic reasons and packagers disagreeing with upstream.

Re: Why does Debian change software?

#28

Post by pabs3 »

lifthrasiir wrote: post #10
guappa wrote: post #8

Earlier quoted context omitted.

Do you have any statistics that show that Debian patches introduce more CVE worthy bugs than the software already contains? OpenSSL doesn't really have a pristine history. Let's not forget that the patch had been posted on the OpenSSL mailing list and had received a go ahead comment before that. Having said that, if you're asking if there's a penetration test team that reviews all the patches. No there isn't. Like th…

That was the kind of answer I wanted to hear, thanks. (Of course I don't think Debian should be blamed for incidents.) Does Debian send other patches as well? For example, I didn't know that Debian also often creates a man page by its own.

Debian definitely aims to contribute upstream, but that doesn't always happen, due to upstream CLAs, because most Debian packagers are volunteers, many Debian contributors are busy, many upstreams are inactive and other reasons.

Re: Why does Debian change software?

#29

Post by steeleduncan »

INTPenis wrote: post #17

This is one of the reasons I switched to RHEL 10+ years ago. I actually prefer the RHEL policy of leaving packages the way upstream packaged them, it means upstream docs are more accurate, I don't have to learn how my OS moves things around. One example that sticks out in memory is postgres, RHEL made no attempt to link its binaries into PATH, I can do that myself with ansible. Another annoying example that sticks ou…

> I actually prefer the RHEL policy of leaving packages the way upstream packaged them

I don't think RHEL is the right choice if this is your criteria. Arch is probably what you are looking for

Post reply on HN