Bug of feature? [LWN.net]

Bug of feature?

Posted Jun 30, 2026 14:35 UTC (Tue) by evgeny (subscriber, #774)
In reply to: Bug of feature? by pizza
Parent article: Xsnow "protestware" in Debian

> Software should do what its authors want it to do. Nothing more, nothing less.

I disagree. A malware does what its authors wanted to do. But is it OK for Debian to knowingly distribute it? In fact, I don't mind, provided it's prominently and very clearly described as such (e.g., "when you install this software, it will silently copy your passwords and send them over to a pirate's account"). But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer. In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions. And, similar to the password sniffer, this hidden feature may put the user's well-being and health at risk.

to post comments

Bug of feature?

Posted Jun 30, 2026 14:44 UTC (Tue) by pizza (subscriber, #46) [Link] (2 responses)

> But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer.

That argument equally applies to web browsers.

Come on. Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute) Which, I might add, runs completely counter to Free Software (and Open Source) principles.

> In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions

"Non-obvious" is, at best, *incredibly* subjective.

Bug of feature?

Posted Jun 30, 2026 15:01 UTC (Tue) by evgeny (subscriber, #774) [Link] (1 responses)

> Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute)

I beg your pardon. First, "write" and "distribute" are very different things. BTW, the Free Software/Open Source licensing terms are largely about the latter. And I fully agree that it's the right of any person to write any kind of software they like.

But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me. I want to believe that Debian makes every effort to fix security holes as quickly as possible. And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

Bug of feature?

Posted Jun 30, 2026 15:10 UTC (Tue) by pizza (subscriber, #46) [Link]

> But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me.

Most software features are "hidden".

> And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

You may wish to believe this, but has it *ever* been the case?

...Except insofar as the importance of "free software" (and the DFSG) is a political opinion, making Debian itself an exclusionary political statement.