Edit: Unrelated to the question but I found this... https://news.ycombinator.com/item?id=40320166

And

From Soren's GH issue, it sounds like the maintainers may remove such functionality in the future. https://github.com/keepassxreboot/keepa … 2104750715

I'm not gonna take a position on this since all of this boils down to "free labor" from all parties. The "drive-by contributor attack" is certainly a valid concern these days, notably with respect to the XZ/LZMA fiasco. This could be an interesting case to investigate...

Edit: The Debian packages site isn't loading for me, but my search engine is fetching results for keypasscx-full and keypassxc-minimal. So...

It kind of reminds me of something microsoft would do.

Microso~1 uploads and stores your passwords in its cloud - without asking of course. Just try the new outlook, it's great!

Edit:
I don't see a problem at all. The full feature version is still existing; beside a more secure, minimal version.

Altoid wrote:
As I understand it, julian-klode's point of view is clearly aligned with the Unix/Linux philosophy.
ie: doing one thing and doing it well.

So how far does this mindset go to preempt a perceived security risk, not an actual risk? Lets start ripping build features out of xorg that might seem superfluous shall we?

I dont understand the reasoning as the password manager has features that directly relate to safe password storage and usage, nothing more nothing less. And on another note, from what i can gather is there could be two packages in the pipeline, one full one minimal. So why bother when the program itself has these build options/features that have been accused of having security risks as opt in not opt out and are turned off by default. On the one hand the full keepassxc is le bad but they will still ship it but have a minimal debian built version?? It kind of reminds me of something microsoft would do.

From what I make out of the OP, the reduced functionality has only been applied to sid, the unstable developement Debian, meaning Excalibur in Devuan.

I'd opine that there is still a long way to go till the package with the reduced functionality actually gets into the Debian stable repositories.

In the meantime, I'm sure a way to get what different users need without going against the basic do one thing and do it well philosophy will be found.

eg: base package for most users plus a set of separately packaged plugins (or similar) for those who need the different additional functionalities.(?)

Just my $0.02.

Best,

A.

I wouldn't be able to use the current Debian package.  That's a no go.

Makes a lot of sense to me.

Much more so with what we have seen happening lately.

As I understand it, julian-klode's point of view is clearly aligned with the Unix/Linux philosophy.
ie: doing one thing and doing it well.

Something to be lauded, not criticised.
As always, YMMV.

Best,

A.

https://github.com/keepassxreboot/keepa … ues/10725/

tldr:

droidmonkey

julian-klode