5 ms·

Long-time Debian user here. For me, Klode made the right call. Someone who wants the bells-and-whistles edition can install it from flatpak.

SilverBirch 2y ago
Do you understand why Klode's behaviour is probably pushing people away from using & contributing to Debian?
- j16sdiz 2y ago
  This is what keep me using debian. Debian have (at least) three flavour of vim, depends on I want lua python ruby or x11 supports. I can install what I need without pulling in gigabytes of dependency. If they start copycating other distro, I will move to other distro.
- hello_computer 2y ago
  Those people are what we call Ubuntu users. For Debian users, Klode is our new sexy-time boyfriend.
  - guilhas 2y ago
    Exactly, recently most discussions around Debian have been "why is it not more like distroX" by people who probability never been interested in Debian to begin with So many distro options, why keep bullying to make them the opposite of what they're known for.. or make them indistinguishable
Brian_K_White 2y ago
Agreed. It's ok to find the extras useful, but it's not automatically right to include them let alone arm them by default. It may not be automatically wrong either because there are a few imo weak arguments that some of the extensions outweigh their own increased attack surface by increasing usage of better passwords genetally and decreasing usage of the copy-paste buffer, so I won't go as far as to say that. But what is wrong is acting like the opposite is also automatically wrong. KeePassXC tooted something like "warning: debian removed all functions" obviously ridiculous unless they removed the function of encrypting and storing passwords. I replied "warning: KeePassXC has confused KeePass users with Lastpass users" If you want convenience over all else, then why are you even using keepass? Google and MS will happily store all your passwords for free and in the cloud and automatically fill them into forms. So convenient! Let alone onepass/lastpass etc. Security is not incidental to this particular apps purpose, it's the central and indeed only purpose. "This is why no one should use debian"? What a ridiculous statement.
- timw4mail 2y ago
  It's not about convenience above all else, it's about that practical balance that allows for the best practical security.
  - Brian_K_White 2y ago
    It's merely the slightest of inconvenience that the default case is safe and you have to click like 2 extra clicks to install and activate more attack surface.
- josephcsible 2y ago
  > it's not automatically right to include them let alone arm them by default. That's an entirely reasonable position when deciding which features to enable when adding a new package to Debian. But it's not reasonable to rip existing features out from under people.
  - Brian_K_White 2y ago
    It's entirely reasonable to say that a bug was fixed. People were accustomed to the bug? Oh well. That tiny inconvenience from having to react to the change is granted. Correcting the bug simply outweighs that.
    - josephcsible 2y ago
      There is no interpretation under which the features that were removed could be considered bugs.
      - Brian_K_White 2y ago
        I did not say the features were bugs. I said it could be considered a bug (in the distribution) to have included those features by default.
lucb1e 2y ago
Long-term Debian user here. Deviating from the featureset offered by the upstream package that had been stable since forever is an unexpected move. Patches usually fix bugs or improve system integration. It is not normal that running apt upgrade breaks a setup. I don't personally use (or knew of) any of the network features in keepassxc, but this is the kind of change that you announce in one release, explaining how people that use it can keep using it, and then apply in the next release. Or, indeed, just make a second package for those who want the hardened setup. There is an argument for the hardened version being the default, but moving from featureful to hardened is a significant change and warrants more than just pushing it and waiting for people to trip over it

SilverBirch 2y ago

Do you understand why Klode's behaviour is probably pushing people away from using & contributing to Debian?

j16sdiz 2y ago
This is what keep me using debian. Debian have (at least) three flavour of vim, depends on I want lua python ruby or x11 supports. I can install what I need without pulling in gigabytes of dependency. If they start copycating other distro, I will move to other distro.
hello_computer 2y ago
Those people are what we call Ubuntu users. For Debian users, Klode is our new sexy-time boyfriend.
- guilhas 2y ago
  Exactly, recently most discussions around Debian have been "why is it not more like distroX" by people who probability never been interested in Debian to begin with So many distro options, why keep bullying to make them the opposite of what they're known for.. or make them indistinguishable

Brian_K_White 2y ago

Agreed. It's ok to find the extras useful, but it's not automatically right to include them let alone arm them by default. It may not be automatically wrong either because there are a few imo weak arguments that some of the extensions outweigh their own increased attack surface by increasing usage of better passwords genetally and decreasing usage of the copy-paste buffer, so I won't go as far as to say that. But what is wrong is acting like the opposite is also automatically wrong. KeePassXC tooted something like "warning: debian removed all functions" obviously ridiculous unless they removed the function of encrypting and storing passwords. I replied "warning: KeePassXC has confused KeePass users with Lastpass users" If you want convenience over all else, then why are you even using keepass? Google and MS will happily store all your passwords for free and in the cloud and automatically fill them into forms. So convenient! Let alone onepass/lastpass etc. Security is not incidental to this particular apps purpose, it's the central and indeed only purpose. "This is why no one should use debian"? What a ridiculous statement.

timw4mail 2y ago
It's not about convenience above all else, it's about that practical balance that allows for the best practical security.
- Brian_K_White 2y ago
  It's merely the slightest of inconvenience that the default case is safe and you have to click like 2 extra clicks to install and activate more attack surface.
josephcsible 2y ago
> it's not automatically right to include them let alone arm them by default. That's an entirely reasonable position when deciding which features to enable when adding a new package to Debian. But it's not reasonable to rip existing features out from under people.
- Brian_K_White 2y ago
  It's entirely reasonable to say that a bug was fixed. People were accustomed to the bug? Oh well. That tiny inconvenience from having to react to the change is granted. Correcting the bug simply outweighs that.
  - josephcsible 2y ago
    There is no interpretation under which the features that were removed could be considered bugs.
    - Brian_K_White 2y ago
      I did not say the features were bugs. I said it could be considered a bug (in the distribution) to have included those features by default.

lucb1e 2y ago

Long-term Debian user here. Deviating from the featureset offered by the upstream package that had been stable since forever is an unexpected move. Patches usually fix bugs or improve system integration. It is not normal that running apt upgrade breaks a setup. I don't personally use (or knew of) any of the network features in keepassxc, but this is the kind of change that you announce in one release, explaining how people that use it can keep using it, and then apply in the next release. Or, indeed, just make a second package for those who want the hardened setup. There is an argument for the hardened version being the default, but moving from featureful to hardened is a significant change and warrants more than just pushing it and waiting for people to trip over it