3 ms·

IF apple said "hey we edited your app because we think its more secure"... People would have torches and pitchforks out. But a deb maintainer does it and ther

IF apple said "hey we edited your app because we think its more secure"... People would have torches and pitchforks out. But a deb maintainer does it and there is debate? If there was a security issue then the insecure version should NOT be available. But again this is not the case. In an App Store world, the role of mainainter has to change. The job is to make the software work with the distro, not keep the name and make some pseudo fork because you want it to be another way.

int_19h 2y ago
Debian does this all the time. There are thousands of .deb packages that are built with patches. In this case, though, it's not even a patch - it's a build flag that is provided by upstream.
- jdbernard 2y ago
  The fact that they are customizing the software is not really the issue. The issue is that they are making a change that will remove significant functionality and in some cases completely lock some users out of their password database, which is a huge deal. Imagine if you wake up tomorrow, run a software update and then can't log in to your bank? I imagine the reason this has blown up so much is that the maintainer never reached out to the upstream about this, and was rude and condescending when upstream reached out to them.
  - kasabali 2y ago
    > Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.
    - redserk 2y ago
      The snark here is unnecessary and completely disconnected from how people use these systems in the real world. Deferring to “it’s in the notes!” means nothing if you have more than a handful of packages on your machine. You should also clarify the assertion that packaging affecting testing target won’t eventually hit stable, because that would be a major change that I haven’t heard about. An end user will get impacted by this eventually.
      - kasabali 2y ago
        > “it’s in the notes!” Your words, not mine. It isn't buried somewhere, it's in NEWS.Debian file, and it's shown to user during the package update by default.
    - LightFog 2y ago
      Are you sure it was shown? I didn’t see one on Sid.
      - kasabali 2y ago
        It's in NEWS.debian file [0], so apt-listchanges (which is installed by default in standard installation) should've shown it. [0] https://salsa.debian.org/debian/keepassxc/-/blob/main/debian/NEWS?ref_type=heads https://salsa.debian.org/debian/keepassxc/-/blob/main/debian...
Vegemeister 2y ago
I've visited the App Store world, and my experience was that, weighted by how often packages appear in search results, the median is charitably described as "potentially unwanted", and honestly described as malware.
out-of-ideas 2y ago
people did not have their pitchforks out for (although not exactly a cve thing) https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-security-incident-12604/ https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-securi...
redeeman 2y ago
flipping build switches that upstream provided is "edited your app" ??

int_19h 2y ago

Debian does this all the time. There are thousands of .deb packages that are built with patches. In this case, though, it's not even a patch - it's a build flag that is provided by upstream.

jdbernard 2y ago
The fact that they are customizing the software is not really the issue. The issue is that they are making a change that will remove significant functionality and in some cases completely lock some users out of their password database, which is a huge deal. Imagine if you wake up tomorrow, run a software update and then can't log in to your bank? I imagine the reason this has blown up so much is that the maintainer never reached out to the upstream about this, and was rude and condescending when upstream reached out to them.
- kasabali 2y ago
  > Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.
  - redserk 2y ago
    The snark here is unnecessary and completely disconnected from how people use these systems in the real world. Deferring to “it’s in the notes!” means nothing if you have more than a handful of packages on your machine. You should also clarify the assertion that packaging affecting testing target won’t eventually hit stable, because that would be a major change that I haven’t heard about. An end user will get impacted by this eventually.
    - kasabali 2y ago
      > “it’s in the notes!” Your words, not mine. It isn't buried somewhere, it's in NEWS.Debian file, and it's shown to user during the package update by default.
  - LightFog 2y ago
    Are you sure it was shown? I didn’t see one on Sid.
    - kasabali 2y ago
      It's in NEWS.debian file [0], so apt-listchanges (which is installed by default in standard installation) should've shown it. [0] https://salsa.debian.org/debian/keepassxc/-/blob/main/debian/NEWS?ref_type=heads https://salsa.debian.org/debian/keepassxc/-/blob/main/debian...

Vegemeister 2y ago

I've visited the App Store world, and my experience was that, weighted by how often packages appear in search results, the median is charitably described as "potentially unwanted", and honestly described as malware.

out-of-ideas 2y ago

people did not have their pitchforks out for (although not exactly a cve thing) https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-security-incident-12604/ https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-securi...

redeeman 2y ago

flipping build switches that upstream provided is "edited your app" ??