Linux

45530 readers

1472 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

111

Debian maintainer unilaterally strips KeepassXC package of a lot of features (fosstodon.org)

submitted 1 month ago by [email protected] to c/[email protected]

55 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 145 points 1 month ago (10 children)

They didn't "strip" anything, they've split it into 2 variants, a package without networking features (-DWITH_XC_NETWORKING=OFF) and a package with them, because it's considered a privacy issue to have your password manager phone home and fetch favicons and so on. The packages will be called keepassxc and keepassxc-full going forward.

[–] [email protected] 35 points 1 month ago* (last edited 1 month ago) (2 children)

Afaiu it, he added a second package with (quote) "all the crap" later, after the storm.

And no, it wasn't just the favicons feature that was removed (which like ... is that really such a big privacy issue that you need to remove it from the binary?). Support for Yubikey was removed as well — which is not a privacy issue. The reasoning mentioned by the Debian maintainer is that all of these features might turn out to be security issues in the long run. Thus, in his view, a password manager application must do nothing but provide access to the database within the app.

I find it an interesting example of diverging upstream, maintainer, and user interests in any case.

[–] [email protected] 42 points 1 month ago* (last edited 1 month ago) (2 children)

I find it a lot of unnecessary fuss over unstable. Sid is supposed to make breaking changes, you offer feedback and you follow it through politely. The next Debian stable is one year away, this is not an urgent matter

[–] [email protected] 21 points 1 month ago

There are so many people who think sid is a distro when really, as far as the Debian project is concerned, it is a staging ground.

[–] [email protected] 0 points 1 month ago

Its also in testing.

[–] [email protected] 19 points 1 month ago

And no, it wasn’t just the favicons feature that was removed (which like … is that really such a big privacy issue that you need to remove it from the binary?)

Fetching a favicon means raising a network connection with a predictable endpoint. That's already three concerns (four on the modern internet) to handle security-wise, and it's absolutely an unneeded feature. Favicons could just be shipped on something like keepassxc-data or keepassxc-contrib to handle locally, no need to raise a network call.

load more comments (7 replies)