Hacker News Reader

Comment by okl | Hacker News Reader

Debian maintainer, Julian Klode, has a "pointed" opinion:

> I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that.

> It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided.

> Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks.

View on HN

I deal with enough packages in my life that do massively breaking changes in point releases though, to be honest. This is reminding me of the good days that `apt upgrade` would uninstall the X-Server because nvidia fucked up their stuff.

Debian is kinda one of the places I expected to be better, and usually it does. (EDIT - And I guess the fact that this is causing a ruckus in testing is an indication of that. lets see how it develops.)

You don't have to proactively read it. But when you notice your keepassxc doesn't work as it used to before, that should be a trigger for you to go back and read it, note that it tells you very clearly that the functionality you're missing is now in keepassxc-full, apt-install it, and go on with your life.

One doesn't expect such a drastic ... 'fix' in a point release though.

You're talking as if it's a point release of Debian. It is not. It happened in sid/testing, that's what these releases are for.

Whether it happened in a point or major release of Keepassxc is irrelevant, because ignorant users who upgrade their sid/testing installations blindly as if it was stable-security would have hit it eventually.

IMO insisting on a change like this would require retiring the original, un-suffixed name. And making separate -min and -full packages instead.

I laughed when I saw this. I once tried to be a hit and run contributor to a project he maintains and I found him to be rude. He is still at it it seems.

That is an absolutely mental stance - effective asserting that he knows better than both the developers and users of a piece of software what features it should have! Promote this man to the Debian technical committee immediately, he's perfect.

My favorite part is that this guy works at Canonical.

Yes, had he been a Fedora maintainer working at Red Hat everyone would be applauding him for his bold decision.

Reply on news.ycombinator.com