Gregory's Server@RL_Dane @Ray_Of_Sunlight @keepassxc looks to be security related when reading https://packages.debian.org/sid/keepassxc: This package includes only the bare minimal functionality, and no security complications like networking, SSH agent, browser plugin, fdo secret storage. See keepassxc-full if you absolutely need those.
|
20 comments
@lieven @RL_Dane @Ray_Of_Sunlight @keepassxc there is a bit more reasoning in the corresponding bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953529  @RL_Dane Not reasonable at all: "I believe most of the people don't want their password manager to connect somewhere they don't know and it will improve user privacy." That's plain badmouthing, nothing else. @j_r @lieven @RL_Dane @Ray_Of_Sunlight that bug report is bunk. He removed ALL features, not just networking. That includes yubikey support, auto-type and browser integration.  @keepassxc @j_r @lieven @RL_Dane @Ray_Of_Sunlight tbf the changelog does say .. "and IPC" .. but that's certainly an 'interesting' choice. I think you could make a strong argument that the missing features reduce more vulnerabilities than they create, and most users will want them. The other-way-around approach of "keepassxc-minimal" v "keepassxc" would have made a lot more sense! @srtcd424 @keepassxc @j_r @lieven @RL_Dane I mean i'm not an expert, i know nothing about this functions, i just like my Offline Password manager 😄  @srtcd424 @keepassxc @j_r @lieven @RL_Dane @Ray_Of_Sunlight remove the features doesn't make much sense. @Ray_Of_Sunlight @srtcd424 @keepassxc @j_r @lieven @RL_Dane because the security argument is valid but not strong enough, and this action create a lot of noise, I'm thinking myself why someone knows whats is better for me ? I always prefer ship packages follow the upstream recommendations, but its just me :) @Ray_Of_Sunlight @r1w1s1 @srtcd424 @keepassxc @j_r @lieven I like flatpak, but prefer to use native packages when I can. Their choice sounds like a dubious one, but as long as there's still a native package with the feature I need, I'll be using that one. @RL_Dane @Ray_Of_Sunlight @r1w1s1 @keepassxc @j_r @lieven I've settled in on flatpaks for "key" or major apps - keepassxc isn't large, but I do consider it important. Allows to me keep on a stable distro and still track up-to-date versions of things. I'm not really a huge fan of the "bundle all dependencies" model, but I've grudgingly accepted that's the world we're in now, and disk is still cheap relative to app sizes even given modern toolkit bloat! @srtcd424 I do like the "bundle with all dependencies", although it makes the package a lil' heavier, it helos not having to download the dependencies on separated servers and who knows when one of them will shut down. Plus, it's cross-distro and it's not like Snaps. @srtcd424 @Ray_Of_Sunlight @r1w1s1 @keepassxc @j_r @lieven Personal choice, of course. I generally don't see the need to have the absolutely latest version of everything. I don't mind being a couple versions behind in Audacity, or using Firefox & Thunderbird ESR. There *are* times where having the latest is more important, where the older versions lack some critical functionality, and for that, I use flatpak. It's all good. ;) @j_r @lieven @RL_Dane @keepassxc That explains everything, Thanks funny-looking puppet guy(No offense intended) 😁 |
@lieven @RL_Dane @keepassxc I'm not a Debian.user, but ty for the advise