Hacker News Reader

Comment by CrLf | Hacker News Reader

This because upstream projects usually can't be bothered to do integration work, and it's up to the distributions to do it and that means patches (which are normally separated from the upstream tarball in the source packages).

Debian adds patches, but so does Red Hat/Fedora. Since these are the two main distributions (maybe not by themselves, but because they form the base for most others), then you criticism can be applied to 99% of the distributions out there.

And bug reports about integration work should go to the distribution, and not upstream developers.

View on HN

Look, I understand that combining gcc/binutils/glibc is a complete clusterfuck that needs some patches (each of these projects is "individually" at least somewhat sane, but they don't like working together at all), and I understand that there is a lot of shitty code in the average desktop environment. Really, some patches probably are necessary. (Although there's a whole debate about feeding them upstream that you could have at this point.)

But why does Debian split up Postfix (well-written, actively maintained) into a zillion different packages stitched together by dynamic loading, instead of just configuring it properly? Why does Debian fuck up OpenSSL?

Disclaimer: Debian Maintainer here.

If you need plain old Postfix, you just aptitude install postfix.

If you need LDAP support in your Postfix instance, you just aptitude install postfix-ldap.

Is it really that hard?

And regarding OpenSSL, the problem is not in Debian. Just check http://people.gnome.org/~markmc/openssl-and-the-gpl.html

OpenSSL always had a problematic license.

No, it's not hard at all - I don't think it took me more than one minute to figure out. It is, however, an example of a gratuitous change.

With respect to the OpenSSL stuff, I'm not talking about the GPL license - I'm talking about http://www.debian.org/security/2008/dsa-1571, one of the most painful security issues in recent memory and caused by a meddling maintainer. (Certainly, the upstream team could have more clearly warned him, but without the maintainers changes everything would have worked just fine.)

I understand you spend a lot of your free time working for free, and I appreciate your good intentions and the good that Debian and Debian's developers have done (e.g. writing lots of man pages for programs that have none) - but I do think Debian has some really questionable sides as well.

Reply on news.ycombinator.com