Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

211–220 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#211

Post by Gerlo »

okl wrote: post #4
HieronymusBosch wrote: post #3

For folks interested this issue on GitHub seems to have the latest comments. https://github.com/keepassxreboot/keepassxc/issues/10725

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…

My favorite part is that this guy works at Canonical.

Re: KeePassXC Debian maintainer has removed all network features

#212

Post by twic »

okl wrote: post #4
HieronymusBosch wrote: post #3

For folks interested this issue on GitHub seems to have the latest comments. https://github.com/keepassxreboot/keepassxc/issues/10725

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…

That is an absolutely mental stance - effective asserting that he knows better than both the developers and users of a piece of software what features it should have! Promote this man to the Debian technical committee immediately, he's perfect.

Re: KeePassXC Debian maintainer has removed all network features

#213

Post by AceJohnny2 »

1oooqooq wrote: post #188
DDiggler wrote: post #134

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3]. Absolutely insan…

why fish for fwupd? systemd-resolved which is everywhere, will open (at request) an LLMNR server (a.k.a. mDNS, nee microsoft netbios) on port 5355. With IoT everyone have access to your LAN, so now people are making sure linux also join the REDACTED party btw, fix for fwupmdg, since they have a low quality default conf file without commented out defaults: ``` # /etc/fwupd/fwupd.conf [fwupd] P2pPolicy=none ``` fix for…

> mDNS, nee microsoft netbios

veering offtopic: I always thought mDNS was an Apple thing, since Bonjour is the most extensive implementation of it (and Windows sucks at it. In fact the only way I found to get a full mDNS implementation on Windows a few years ago was to install Bonjour via an installer extracted from iTunes for Windows).

The Wikipedia page for mDNS [1] doesn't have a lot of history information, saying just that the idea of mDNS was first proposed by Bill Woodcock & Bill Manning to the IETF in 2000, and neither seem obviously tied to Microsoft. Apple later published Bonjour in 2002, and mDNS only became an official rfc6762 in 2013!

[1] https://en.wikipedia.org/wiki/Multicast_DNS

Re: KeePassXC Debian maintainer has removed all network features

#214

Post by techwizrd »

roenxi wrote: post #209
thaumaturgy wrote: post #111

Earlier quoted context omitted.

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding. > Package maintainers aren't self-sacrificial saints or all that unique as volunteers go. If you want keepassx, you can go install it. If you want the Debian a…

Is it a _fundamentally_ bad idea? The connected syncing feature of Bitwarden is one of my favorite things. I can save a password on one device, and its automagically available on others all while staying encrypted (and audited).

Re: KeePassXC Debian maintainer has removed all network features

#215

Post by GorsyGentle »

rfoo wrote: post #57
jeffalyanak wrote: post #46

I think the solution suggested by drawks seems clearly the correct choice: > I think the proper solution would probably be to package both a "-full" and "-minimal" version of the software and utilize Debian package meta-data fields to define a Conflicts relationship between the packages and tag them also both with a Provides for keepassxc and also add a tag Replaces: keepassxc to the -full build so that during a pack…

Because maintainers have an opinion and explicitly wanted to change the default.

Perhaps, and that's not unreasonable in and of itself. But to do so in such a user-hostile manner? That's a bit over the top. A new minimal package, advertising it, and only then eventually making it the default would have been far, far more effective.

If an engineer of mine pulled this on our user-base I'd have them reverting it in a heartbeat regardless of the technical merit. They already failed just in how they executed this and have burned good will, the technical merits no longer matter. Once you've lost the faith and trust of the user, it's over.

The original request[0] was more or less simply a user asking for the networking to be removed, and follow-up to just have a -nonetwork variation. Instead, we have comments from the debian maintainer:

The OP report: > Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks.

The debian package description[1]: > See keepassxc-full if you absolutely need those.

The PR[2] > Feature creep like SSH agent support, browser integration, Freedesktop.org secret storage, KeeShare pose undue risks for most users.

Each one of these sends a message. And it was entirely avoidable with a bit of grace and kindness to the existing userbase.

[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529

[1]: https://packages.debian.org/sid/keepassxc

[2]: https://salsa.debian.org/debian/keepassxc/-/commit/7d6d16e3f...

Re: KeePassXC Debian maintainer has removed all network features

#216

Post by Dalewyn »

roenxi wrote: post #209
thaumaturgy wrote: post #111

Earlier quoted context omitted.

I anticipated this reply, either here or elsewhere, and was really hoping it wouldn't arrive. I do a lot of volunteer work too. Guess what? My decisions in those roles are not unimpeachable. Being a volunteer also does not mean you are owed anything, even gratitude. It's a thing you choose to do, and if you don't like doing it anymore, then you should stop doing it. Package maintainers aren't self-sacrificial saints…

Connecting the internet and a password database together is one of those fundamentally bad ideas. This might well be an excellent technical decision. Although I agree with the thread root that this is a level of intervention that might justify some rebranding. > Package maintainers aren't self-sacrificial saints or all that unique as volunteers go. If you want keepassx, you can go install it. If you want the Debian a…

>And some reasonable expectations of respect.

Volunteers by definition do not (or at least should not) expect anything in return for their time. If you want respect as a so-called volunteer, you're not a volunteer.

I've seen both good and bad package maintainers, too.

Re: KeePassXC Debian maintainer has removed all network features

#217

Post by NikkiA »

worble wrote: post #90
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

> calling your upstream "crappy"[0] is probably not the most productive way for package maintainer to act This is so incredibly rude to post on the github it'd make me reconsider using Debian at all if I did. If the package is so full of "crappy" features why is he even bothering to maintain it? Just get rid of it and let users figure out how to install it properly themselves. I feel bad for KeepassXC devs, maintaini…

TBF he's a canonical employee, not a debian employee, he's paid to maintain Ubuntu packages, but volunteers for the debian ones, so I'd be more side-eyeing Ubuntu first.

But then I gave up on debian a while ago because of some of their more questionable decisions.

Re: KeePassXC Debian maintainer has removed all network features

#218

Post by cyanydeez »

tuetuopay wrote: post #136

So in the end they reduced the attack surface for a program running on your computer by increasing the attack surface on the meatbag operating the computer? (i.e. browser integration which is the only effective thing against phishing) Seems like a good deal /s

This reminds me of the how to secure a trashcan from bears in yellow stone: the dumbest person and the smartest bear has significant overlap.

Protecting a few dumb people means exposing a lot more people to attack vectors.

Re: KeePassXC Debian maintainer has removed all network features

#219

Post by cyanydeez »

jeroenhd wrote: post #208
Brian_K_White wrote: post #69

Earlier quoted context omitted.

Thinking browser or other local integration is not as dangerous as network features is nonsensical. All of the disabled features are expendable. I never used any even while they were in there. Yet I do use keepassxc all day every day for the one job it actually does exist to do. Convenience and necessity are two different things. You want conveninece, and you're not wrong to want it, but you don't need it, and your w…

Browser integration, if done well, is actually more secure than the copy+pasting you end up doing otherwise. Storing passwords in the clipboard is a massive security risk, as the clipboard is shared by all applications and websites, while direct browser integrations allow for only providing the credentials to the specific web page they're meant for. While I'm not opposed to differentiating between a -full and a -mini…

>if done well

Is that xkcd of a tiny project doing a lot of heavy lifting.

Post reply on HN