Bug of feature? [LWN.net]

Bug of feature?

Posted Jun 30, 2026 14:17 UTC (Tue) by pizza (subscriber, #46)
In reply to: Bug of feature? by alx.manpages
Parent article: Xsnow "protestware" in Debian

> Should Debian packages behave differently for those people?

Only if those behavioral differences are due to an action taken on Debian's part.

But as the behavioral differences are *upstream*, this is a very different conversation.

> I don't mean that programmers should not discriminate people by their political opinions. But I think software should not do it blindly.

Software should do what its authors want it to do. Nothing more, nothing less.

However, as 'xsnow' is Free Software, its users have the right alter the software to do what *they* want, ie becoming authors themselves.

to post comments

Bug of feature?

Posted Jun 30, 2026 14:35 UTC (Tue) by evgeny (subscriber, #774) [Link] (3 responses)

> Software should do what its authors want it to do. Nothing more, nothing less.

I disagree. A malware does what its authors wanted to do. But is it OK for Debian to knowingly distribute it? In fact, I don't mind, provided it's prominently and very clearly described as such (e.g., "when you install this software, it will silently copy your passwords and send them over to a pirate's account"). But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer. In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions. And, similar to the password sniffer, this hidden feature may put the user's well-being and health at risk.

Bug of feature?

Posted Jun 30, 2026 14:44 UTC (Tue) by pizza (subscriber, #46) [Link] (2 responses)

> But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer.

That argument equally applies to web browsers.

Come on. Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute) Which, I might add, runs completely counter to Free Software (and Open Source) principles.

> In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions

"Non-obvious" is, at best, *incredibly* subjective.

Bug of feature?

Posted Jun 30, 2026 15:01 UTC (Tue) by evgeny (subscriber, #774) [Link] (1 responses)

> Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute)

I beg your pardon. First, "write" and "distribute" are very different things. BTW, the Free Software/Open Source licensing terms are largely about the latter. And I fully agree that it's the right of any person to write any kind of software they like.

But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me. I want to believe that Debian makes every effort to fix security holes as quickly as possible. And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

Bug of feature?

Posted Jun 30, 2026 15:10 UTC (Tue) by pizza (subscriber, #46) [Link]

> But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me.

Most software features are "hidden".

> And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

You may wish to believe this, but has it *ever* been the case?

...Except insofar as the importance of "free software" (and the DFSG) is a political opinion, making Debian itself an exclusionary political statement.