6 ms·

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default.

by okl 2y ago

Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided. > Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks.

lupusreal 2y ago
[flagged]
- nulld3v 2y ago
  They removed other non-networking features too. E.g. even autotype was removed. At that point why not just store your passwords in an encrypted notes app?
  - zikduruqe 2y ago
    Just use https://www.passwordstore.org https://www.passwordstore.org
  - lupusreal 2y ago
    I use KeePassXC, but not any network features or autotyping, because I like the password generation and because the interface is nice. I previously used Vim's old encryption feature (since removed I think?) and I think KeePassXC as I use it is a good upgrade from that.
- jdbernard 2y ago
  Or maybe just fork the project instead and let users who want these features use the package the way the authors intended. There are multiple KeePass implementations. The people using this one are doing so because they want its features.
tetha 2y ago
> I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. I deal with enough packages in my life that do massively breaking changes in point releases though, to be honest. This is reminding me of the good days that `apt upgrade` would uninstall the X-Server because nvidia fucked up their stuff. Debian is kinda one of the places I expected to be better, and usually it does. (EDIT - And I guess the fact that this is causing a ruckus in testing is an indication of that. lets see how it develops.)
- Arnavion 2y ago
  You don't have to proactively read it. But when you notice your keepassxc doesn't work as it used to before, that should be a trigger for you to go back and read it, note that it tells you very clearly that the functionality you're missing is now in keepassxc-full, apt-install it, and go on with your life.
  - paulryanrogers 2y ago
    One doesn't expect such a drastic ... 'fix' in a point release though.
    - kasabali 2y ago
      You're talking as if it's a point release of Debian. It is not. It happened in sid/testing, that's what these releases are for. Whether it happened in a point or major release of Keepassxc is irrelevant, because ignorant users who upgrade their sid/testing installations blindly as if it was stable-security would have hit it eventually.
      - paulryanrogers 2y ago
        IMO insisting on a change like this would require retiring the original, un-suffixed name. And making separate -min and -full packages instead.
ATMLOTTOBEER 2y ago
I laughed when I saw this. I once tried to be a hit and run contributor to a project he maintains and I found him to be rude. He is still at it it seems.
Gerlo 2y ago
My favorite part is that this guy works at Canonical.
- kasabali 2y ago
  Yes, had he been a Fedora maintainer working at Red Hat everyone would be applauding him for his bold decision.
twic 2y ago
That is an absolutely mental stance - effective asserting that he knows better than both the developers and users of a piece of software what features it should have! Promote this man to the Debian technical committee immediately, he's perfect.

by okl 2y ago

lupusreal 2y ago

[flagged]

nulld3v 2y ago
They removed other non-networking features too. E.g. even autotype was removed. At that point why not just store your passwords in an encrypted notes app?
- zikduruqe 2y ago
  Just use https://www.passwordstore.org https://www.passwordstore.org
- lupusreal 2y ago
  I use KeePassXC, but not any network features or autotyping, because I like the password generation and because the interface is nice. I previously used Vim's old encryption feature (since removed I think?) and I think KeePassXC as I use it is a good upgrade from that.
jdbernard 2y ago
Or maybe just fork the project instead and let users who want these features use the package the way the authors intended. There are multiple KeePass implementations. The people using this one are doing so because they want its features.

tetha 2y ago

> I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. I deal with enough packages in my life that do massively breaking changes in point releases though, to be honest. This is reminding me of the good days that `apt upgrade` would uninstall the X-Server because nvidia fucked up their stuff. Debian is kinda one of the places I expected to be better, and usually it does. (EDIT - And I guess the fact that this is causing a ruckus in testing is an indication of that. lets see how it develops.)

Arnavion 2y ago
You don't have to proactively read it. But when you notice your keepassxc doesn't work as it used to before, that should be a trigger for you to go back and read it, note that it tells you very clearly that the functionality you're missing is now in keepassxc-full, apt-install it, and go on with your life.
- paulryanrogers 2y ago
  One doesn't expect such a drastic ... 'fix' in a point release though.
  - kasabali 2y ago
    You're talking as if it's a point release of Debian. It is not. It happened in sid/testing, that's what these releases are for. Whether it happened in a point or major release of Keepassxc is irrelevant, because ignorant users who upgrade their sid/testing installations blindly as if it was stable-security would have hit it eventually.
    - paulryanrogers 2y ago
      IMO insisting on a change like this would require retiring the original, un-suffixed name. And making separate -min and -full packages instead.

ATMLOTTOBEER 2y ago

I laughed when I saw this. I once tried to be a hit and run contributor to a project he maintains and I found him to be rude. He is still at it it seems.

Gerlo 2y ago

My favorite part is that this guy works at Canonical.

kasabali 2y ago
Yes, had he been a Fedora maintainer working at Red Hat everyone would be applauding him for his bold decision.

twic 2y ago

That is an absolutely mental stance - effective asserting that he knows better than both the developers and users of a piece of software what features it should have! Promote this man to the Debian technical committee immediately, he's perfect.