Don’t debian packages have use flags like gentoo does ? Surely it’s not hard to compile the binary with every possible combination of build flag in 2024 ?
There’s a keepassxc-full package that comes with all the functionality. Anyhow, Debian does not have the concept of USE flags, these don’t make sense in a binary-based distribution.
The response by the debian maintainer responsible for this change to the keepassxc developer is an actual disgrace
Request to revert change:
@julian-klode this needs to be reverted asap. This is now our fourth bug report because of the decision to neuter the base KeePassXC package in Debian. Put the base package back where it was and create a keepassxc-minimal.
Response by debian maintainer:
julian-klode commented 9 hours ago: I’m afraid that’s not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there’s little that can be done about that. It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided. Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks.
The whole github issue is worth a read, as it actually explains the issue with the change.
Edit: as i gave the debian maintainers view visibility i wanted to give a quick summary of the keepassxc point of view as well:
-
julian-klode specifically mentions attacks by contributors of keepassxc. If you don’t trust the developers, why would you trust the minimal package which is developed by the same people?
-
If the Debian packagers have good reason to believe the keepassxc-full version presents a broader attack surface, then they ought to present what they’ve seen that makes them feel that way, not promote baseless innuendo.
-
the features are disabled by default. If you do not opt in, the code never gets executed.
-
the safest version of keepassxc is the one thats tested, meaning full featured
-
removing all those features doesn’t make it more secure, it dumbs it down to an encrypted spreadsheet and makes it less secure. Users should be automatically notified when one of their accounts has been breached and their password for that account has been found floating in a db dump. Users should rely on their password manager to handle logins for them, so they’re less likely to get tricked into a phishing page.
-
if you disagree with features in someones app you fork it. You do not change it and distribute it under the same name. A -minimal version would have been ok
-
Debians own policy is to communicate with upstream beforehand before introducing changes. This was not the case, nor was there a chance to collaborate on an effective solution for both parties.
-
Debian could have chosen to give users an informed choice between -full and -minimal. Instead they broke existing users installs.
-
People saying it was released in Debian sid, which is meant for changes. It is also meant for Feedback, which julian-klode refuses to listen to.
He’s not wrong but he sounds like a jackass. A minimal version sounds better than removing features that are present and used by people.
At first i thought some reasons sounded reasonable too, but after reading the github issue i changed my mind. See my edit for reasons.
-
They didn’t “strip” anything, they’ve split it into 2 variants, a package without networking features (
-DWITH_XC_NETWORKING=OFF) and a package with them, because it’s considered a privacy issue to have your password manager phone home and fetch favicons and so on. The packages will be calledkeepassxcandkeepassxc-fullgoing forward.Afaiu it, he added a second package with (quote) “all the crap” later, after the storm.
And no, it wasn’t just the favicons feature that was removed (which like … is that really such a big privacy issue that you need to remove it from the binary?). Support for Yubikey was removed as well — which is not a privacy issue. The reasoning mentioned by the Debian maintainer is that all of these features might turn out to be security issues in the long run. Thus, in his view, a password manager application must do nothing but provide access to the database within the app.
I find it an interesting example of diverging upstream, maintainer, and user interests in any case.
The Debian maintainer is probably a volunteer. Can we not troll people who make Debian and Foss possible?
You have a point to some degree, yet I still think it is defensible to make this post. He majorly altered software
- downstream
- against user expectations
- for somewhat spurious reasons
- seemingly quite ad-hoc
He then went on to defend that decision in a less-than-graceful way before announcing there will be a second, new package.
But, to make it clear: I certainly don’t approve of hate directed toward him and I don’t have a personal issue with him.
Aren’t the networking features just toggles in the settings already? I remember seeing several of the mentioned features in there.
Yes, these are off-by-default features.
