Bug of feature? [LWN.net]

Bug of feature?

Posted Jun 30, 2026 21:26 UTC (Tue) by rra (subscriber, #99804)
In reply to: Bug of feature? by evgeny
Parent article: Xsnow "protestware" in Debian

> I believe it's an important topic in general (not just this specific project or even Debian). It appears Debian, and many other Linux distros (probably all) don't even try to regulate the (in)discriminatory behavior of the software they ship.

Casting this as an argument about "discriminatory behavior" is, I think, a huge tactical mistake that makes it less likely that your legitimate concerns will be ignored. That is a wildly subjective standard that has been a matter of political controversy for at least 150 years. Just in my own country there have been heated arguments, physical violence, and even mass murder over whether such things as "separate but equal" constitute discriminatory behavior. You will never reach a political consensus on what that means, and most free software projects will be unwilling to touch this argument with a ten-foot pole because the signal to noise ratio is awful.

And you don't have to! Because there's a much more obvious problem here, which I tried to point out in the thread: Deceptive behavior by the software. This is a very mild case of that, to be clear, but it is a case of that, and I think that's a standard for which you would be far more likely to reach consensus.

If the description of xsnow said "this program shows Ukraine flags while it's running," this is still just as discriminatory (or not, depending on what side of that very unresolved and probably unresolvable argument you are on), but it doesn't pose the same concrete problem. If you were in Russia and you saw that in the description, you would just not install it. People who installed it and ran it would not be surprised. Problem solved, without having to resolve one of the trickiest disagreements in political science.

This is a general problem that I see in free software arguments all the time: In order to make an argument more appealing, people attach it to some high-emotion, high-salience political argument of the day, but in so doing they tie their argument into that political fight and pretty much guarantee the resulting discussion will go off-topic and will probably flame out with no effect. But if you look more closely at the concrete problem, often there is a much less controversial and much less emotionally-charged point that could be made. It won't feel as emotionally satisfying and it won't feel like you're taking a brave stance against your political enemies, but it's a lot more likely to cause change in the world.

to post comments

Bug of feature?

Posted Jul 1, 2026 8:44 UTC (Wed) by evgeny (subscriber, #774) [Link] (24 responses)

> Casting this as an argument about "discriminatory behavior" is, I think, a huge tactical mistake that makes it less likely that your legitimate concerns will be ignored. That is a wildly subjective standard that has been a matter of political controversy for at least 150 years.

I don't understand what is subjective about discrimination. Let's use Wikipedia's definition:

"Discrimination is the process of making unjustified distinctions between people based on the groups, classes, or other categories to which they belong or are perceived to belong, usually in a way that deprives them of their legal or human rights."

So let me stress: discrimination is a *process* of making *unjustified* distinctions between people. The political or other implications are mere consequences that may or may not ("usually") happen as a result.

> If the description of xsnow said "this program shows Ukraine flags while it's running," this is still just as discriminatory (or not, depending on what side of that very unresolved and probably unresolvable argument you are on), but it doesn't pose the same concrete problem. If you were in Russia and you saw that in the description, you would just not install it. People who installed it and ran it would not be surprised. Problem solved, without having to resolve one of the trickiest disagreements in political science.

Not at all. The problem is *not* in displaying the Ukrainian (or any other) flag per se. There could be a zillion reasons why the author might wish to do it. Anything from being born in Ukraine to aesthetically enjoying the combination of blue and yellow. I'm fine with it. Yes, describing this behavior would be helpful for those who might be hurt or offended by it. But I cannot, and don't want to, demand that any software creator consider all possible consequences (including those arising from future political changes in a remote part of the world) of their decision.

The problem lies with the *discriminatory* behavior of xsnow: the probability of showing or not the flag varies strongly (by more than an order of magnitude) with the user's ethnicity. And this decision is *unjustified*. There is no reasonable jurisdiction in the world that would approve it. Even the Constitution of Ukraine (Article 10) explicitly declares "Free development, use, and protection of Russian and other languages".

I don't know how to explain it better. Say, if instead of showing the Ukrainian flag, the author decided to run "rm -rf ~" if the locale is "ru", would you approve it? There is no principal difference here. In fact, for a true Putin antagonist living in Russia, this outcome might be more preferable than the Ukrainian flag popping up unexpectedly in public. Some Westerners don't realize what it means to live under an oppressive regime, and play with other people's lives at ease.

Bug of feature?

Posted Jul 1, 2026 15:02 UTC (Wed) by rra (subscriber, #99804) [Link] (23 responses)

> I don't understand what is subjective about discrimination.

I understand that you (like most people making political arguments about discrimination) think your definition of discrimination is clearly correct and obvious and follows from dictionary definitions. I'm not going to argue with you about that, because that's not my point. My point is that pursuing this line of argument is likely to hurt your ability to get what you want because it creates a bunch of unnecessary controversy that people will disagree with, whether you think they should or not. Regardless of whether you are correct, it is a self-defeating tactic and it is much more likely to lead to people ignoring you.

You can of course decide that I'm wrong and continue down this course anyway, and maybe I am wrong! Free advice is worth what you paid for it.

> Say, if instead of showing the Ukrainian flag, the author decided to run "rm -rf ~" if the locale is "ru", would you approve it?

Suppose that the software just ran "rm -rf ~" unconditionally regardless of the locale. This clearly is not discriminatory in any way whatsoever. So it's okay, then?

Software that deletes the user's home directory unexpectedly and without the user's permission is clearly a bad thing to have in a distribution and you would have very little trouble getting the distribution to remove it. The reason and conditions under which it does that are basically irrelevant.

xsnow is a harder case because the change of behavior is subtle and is not obviously destructive. But I think the same principle applies: one of the core principles of free software is that the user should be in control of the software running on their device, and software that is deceptively coded in a way that is potentially hostile to the interests of the user undermines that principle. It's one thing if the easter egg is intended to amuse or delight when someone stumbles across it and can be seen as a game the author is playing with the user, but I think that's hard to defend here.

But if, instead of pointing out that the software does things deceptively behind the user's back, thus violating a very widely-held consensus in the free software community about how software should behave, you instead decided to make the argument about a contemporary political issue, you might manage to sabotage your argument enough that some people would argue against you. (Probably not for rm -rf ~, since the damage done is so obviously severe, but I am watching it happen right now with the Ukraine flag, because of the grounds on which you chose to fight.)

Bug of feature?

Posted Jul 1, 2026 15:28 UTC (Wed) by evgeny (subscriber, #774) [Link] (5 responses)

> Suppose that the software just ran "rm -rf ~" unconditionally regardless of the locale. This clearly is not discriminatory in any way whatsoever. So it's okay, then?

No, it isn't, but for a different reason. Just as punching an average passerby in the face because you're drunk or consciously choosing for that purpose a representative of a specific race/gender/etc are different criminal offenses, with quite different legal consequences under most jurisdictions.

Bug of feature?

Posted Jul 1, 2026 18:36 UTC (Wed) by rra (subscriber, #99804) [Link] (1 responses)

Thinking that one's motive in punching someone in the face should result in an entirely different criminal offense is certainly a political position that you could hold. It's one I generally disagree with, so I'm not going to take any actions based on that belief because I think that belief is wrong. If you insist that I am required to agree with you on that point, I'm likely to be unwilling to collaborate with you even on unrelated things, and may simply block all your messages.

Now, do you want to turn the whole discussion into arguing about that, or do you want to instead focus on our point of agreement, which is that people shouldn't be punched in the face?

Bug of feature?

Posted Jul 1, 2026 19:14 UTC (Wed) by evgeny (subscriber, #774) [Link]

> Thinking that one's motive in punching someone in the face should result in an entirely different criminal offense is certainly a political position that you could hold.

My political position is rather irrelevant. Hate crime (https://en.wikipedia.org/wiki/Hate_crime) is a concept recognized in the jurisprudence of many countries.

> Now, do you want to turn the whole discussion into arguing about that, or do you want to instead focus on our point of agreement, which is that people shouldn't be punched in the face?

Yes, people shouldn't be punched in the face. We agree on that. I further firmly believe that when certain people are punched in the face only because their face has special ethnic traits (and the rest of the population doesn't see it as a problem), the society is seriously sick.

Bug of feature?

Posted Jul 1, 2026 18:49 UTC (Wed) by malmedal (subscriber, #56172) [Link] (2 responses)

Just to come back to the original disagreement here.

Your point is that in the current situation with an agressor doing an unprovoked and illegal attack. Somebody is doing a non-violent protest against this. And this non-violent protest is immoral because somebody in the aggressor nation might do violence to other people also in the agressor nation?
Do I have this right? Am I missing something?

Bug of feature?

Posted Jul 1, 2026 20:08 UTC (Wed) by evgeny (subscriber, #774) [Link] (1 responses)

Yep, that's a correct description. FYI, it's called collective punishment.

Bug of feature?

Posted Jul 1, 2026 20:54 UTC (Wed) by malmedal (subscriber, #56172) [Link]

Closer to the practice of "human shields" where a combatant deliberately places civilians near military targets(or moves the targets to where the civilans are) with the goal that the other side will be to humanitarian to drop any bombs. Not an exact match though. The equivalent would be for somebody to attack their own people in order to deter the enemy from attacking. Can't think of any instance where this has actually been tried...

Bug of feature?

Posted Jul 1, 2026 16:15 UTC (Wed) by pizza (subscriber, #46) [Link] (16 responses)

> one of the core principles of free software is that the user should be in control of the software running on their device

You left out "...by having the complete corresponding source code that they can inspect and modify if they so choose"

No "Free Software Principles" say that a given user is entitled to not be surprised by unexpected or even deceptive program behavior; they only get the right to change the behavior they do not want/like.

Bug of feature?

Posted Jul 1, 2026 18:15 UTC (Wed) by rra (subscriber, #99804) [Link] (15 responses)

No, I didn't leave that out. I don't agree. I don't think providing the source is the sole obligation and as long as you provide the source, the program can do anything. And, phrasing aside, I'm sure you don't think that either: If, say, GNU coreutils started shipping malware inside its source code that sends all of your credentials to the FSF (intentionally absurd example), you'd say that was obviously wrong.

So, I think you're disagreeing with me on semantics. You would agree this is wrong, but not necessarily that it's wrong because it's a violation of free software principles, but instead that it's wrong because it's malware. And my point in this entire thread is that this is a distinction without a difference if your goal is to just stop programs from doing unexpected, deceptive things. It doesn't really mater *why* you're opposed to software doing unexpected, deceptive things; there's a general consensus that is bad for any number of different reasons.

I suppose the gap, the place where there could still be some disagreement, is that one can believe programs doing malicious or deceptive things is bad (regardless of whether you would phrase the principle the same way that I would), but what xsnow is doing is not sufficiently bad to warrant any concern. That's fine, I think that's a reasonable point on which people can disagree, and is probably the argument that we should be having. So I think we mostly agree on my point on argument structure.

The point that I'm trying to make is that saying that this is "discrimination" is not going to help. We need to argue about the actual concrete impact; trying to turn that into an emotionally charged political dispute by calling it "discrimination" is just going to cause people to tune it out or even oppose any change for political reasons.

Bug of feature?

Posted Jul 1, 2026 20:02 UTC (Wed) by pizza (subscriber, #46) [Link] (14 responses)

> I don't think providing the source is the sole obligation and as long as you provide the source, the program can do anything. And, phrasing aside, I'm sure you don't think that either:

Actually, I *do* firmly believe that -- "This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."

Don't get me wrong, I wouldn't intentionally use software I know to be actively malicious. But the difference between "malicious" and merely "very buggy" can be pretty hard to discern, and either way the user assumes all risks as an up-front condition of being able to use the software to begin with. Ultimately the only way to truly know what a given piece of software does is an exhaustive code review.

Bug of feature?

Posted Jul 1, 2026 20:13 UTC (Wed) by rra (subscriber, #99804) [Link] (13 responses)

Oh, okay, yes, that's a fair point, I am also a firm believer that people should actually read the disclaimer in the license and the author doesn't have an obligation to write the software that you want to use.

I think there's a little bit of nuance because the author does have some power that they've gained through trust, and abusing that power while pointing to the license is not really how trust works between humans. But as far as I'd go with that is that I don't think they should trick people intentionally, and I get pretty annoyed with the people who claim that free software authors have some obligation to their users beyond that.

All that said, this was in the context of someone asking Debian, a distribution, to do something, and as much as I support the author's right to release whatever software they want to write, I do think (speaking as a member of the Debian Project) that we should have some shared standards about what software we want to include in the distribution. In general, I think doing things deceptively behind the back of the user should be disqualifying. It doesn't fit what we're trying to accomplish in assembling a distribution. Whether this specific example is serious enough to meet that bar is arguable.

We don't accept very buggy software either. Part of the role of a distribution is to apply some vetting standards, IMO.

> Ultimately the only way to truly know what a given piece of software does is an exhaustive code review.

I do think it's important to not be too flippant about the level of social trust that's required to use software in the modern world (and a whole lot of other things besides software as well). We go through our daily lives implicitly relying on the good will of other people in innumerable ways, and there is absolutely no way that we could personally audit even a tiny fraction of the systems, services, and software that we rely on. We live in a society built on some level of mutual trust. Not all humans are trustworthy, so we do need some mechanism to distribute the verification of that trust and to discourage breaking that trust, or society would fall apart. We can't just have caveat emptor be the entirety of our moral calculus; the resulting libertarian hellscape would be unsurvivable. (And to be clear, I don't think that's what you're arguing for; that's just where my thoughts went when reading the last sentence of your message.)

Bug of feature?

Posted Jul 1, 2026 22:49 UTC (Wed) by pizza (subscriber, #46) [Link] (12 responses)

> All that said, this was in the context of someone asking Debian, a distribution, to do something, and as much as I support the author's right to release whatever software they want to write, I do think (speaking as a member of the Debian Project) that we should have some shared standards about what software we want to include in the distribution.

That's a reasonable attitude to take, but the key is "shared standards" (which don't actually exist yet, at least not in a way that would apply in this context)

> We don't accept very buggy software either. Part of the role of a distribution is to apply some vetting standards, IMO.

Again, what relation do "some vetting standards" have to do with the situation at hand?

>I do think it's important to not be too flippant about the level of social trust that's required to use software in the modern world

Believe me, I wasn't being flippant, just stating a hard truth that we all have to keep in mind.

Debian (and its developers/packagers) doesn't make any general promises about the software it ships, beyond the claim that a binary matches its corresponding ingredients + recipe [1] and integrates reasonably [2] well with the rest of the system. That's it.

There will undoubtedly be bugs, and there could easily be features some users don't expect, even to the point of being offensive/objectionable. Realistically, the only ones that truly know what a given piece of software is _intended_ to do [3] are its actual authors; for any others to have that confidence the software would have to be subjected to an exhaustively comprehensive audit. Vanishingly few packages in Debian qualify on that front.

Debian doesn't promise any particular outcome, just a best effort towards its stated/shared goals, and a process to achieve (and participate in) that.

[1] ie a given source tarball, with an enumerated set of patches applied and compiled in a particular manner
[2] compliance with Debian's various technical and administrative policies.
[3] which isn't necessarily what it _actually_ does, thanks to bugs

Bug of feature?

Posted Jul 1, 2026 22:58 UTC (Wed) by rra (subscriber, #99804) [Link] (11 responses)

> That's a reasonable attitude to take, but the key is "shared standards" (which don't actually exist yet, at least not in a way that would apply in this context)

Agreed. The way that one starts establishing such shared standards is to state what standards one would like to see and see how other members of the project react to them, which is what I did in the post cited all the way back in the original LWN article. Usually this process takes a long time and multiple separate events, and often the consensus is somewhat informal and takes a long time to be written down formally (if it ever is).

My stance is that I don't particularly care about "discrimination" because it means too many different things to different people, some of which I sharply disagree with. But I don't think we should include software that intentionally deceives the user about what it's going to do by, for instance, hiding behavior behind triggers that the user would not expect to have an effect. This is a very minor instance of that general principle, and thus not the greatest test case and probably not the package that will create a lot of consensus, but it's a good opportunity to state the principle and ask people to think about it. I'm sure this will come up again.

> Debian (and its developers/packagers) doesn't make any general promises about the software it ships

And indeed we should not, for a whole bunch of reasons including the obvious legal ones.

> Debian doesn't promise any particular outcome, just a best effort towards its stated/shared goals, and a process to achieve (and participate in) that.

Exactly. We are trying to do a bunch of things that we do not promise we will succeed at. This is, in general, how societies work and how mutual trust is built. Very few of the assumptions of trust are based on formal or enforceable promises. A lot is just good faith effort and attempts to avoid forseeable problems.

Bug of feature?

Posted Jul 2, 2026 10:08 UTC (Thu) by farnz (subscriber, #17727) [Link] (10 responses)

Part of the issue here is that there's no morally neutral shared standards to be found.

If you insist that upstream expressions of support for Ukraine are removed to protect residents of the Russian Federation, you upset one group to protect another. If you allow them to be kept in, as long as they're also upstream, you upset a different group to protect another.

This means that one of the questions Debian needs to be asking itself is "who are we willing to upset?".

Bug of feature?

Posted Jul 2, 2026 10:27 UTC (Thu) by evgeny (subscriber, #774) [Link] (9 responses)

It's not about "upsetting" - unless by upsetting you mean potentially physical violence and/or legal actions. It's quite similar to the issue of free speech - you're free to express your opinion as long as it doesn't hurt (not morally, not!) somebody else.

And, BTW, please explain why an average Ukrainian gets upset by knowing that an average Russian user of Xsnow sees the Ukrainian flag with the same frequency or doesn't see it at all?

The only person who may be upset by reverting this feature is Xsnow's author. And he has already agreed to do it.

Bug of feature?

Posted Jul 2, 2026 10:41 UTC (Thu) by farnz (subscriber, #17727) [Link] (8 responses)

Or, to put it as a Ukrainian friend has: "because Russian criminals are violent, Russians have pressured the xsnow maintainer into removing an expression of support for us - Debian is happy to see Ukrainian civilians killed by Russian military, but not Russians forced to stop using a little desktop toy for fear of their local criminals".

Bug of feature?

Posted Jul 2, 2026 11:00 UTC (Thu) by evgeny (subscriber, #774) [Link] (7 responses)

Do you believe *any* Russian citizen, unconditionally, whether they are a combatant or not, whether they support the war or not, whether they are a child or not, must be punished? I want to hear your opinion, not your hypothetical Ukrainian friend.

Bug of feature?

Posted Jul 2, 2026 11:25 UTC (Thu) by pizza (subscriber, #46) [Link] (4 responses)

> Do you believe *any* Russian citizen, unconditionally, whether they are a combatant or not, whether they support the war or not, whether they are a child or not, must be punished? I want to hear your opinion, not your hypothetical Ukrainian friend.

Do you believe in collectively punishing *everyone else* is an acceptable way to avoid possibly punishing any Russian citizen?

Because that's the other side of your very-much-hypothetical question.

Bug of feature?

Posted Jul 2, 2026 11:38 UTC (Thu) by evgeny (subscriber, #774) [Link]

> Do you believe in collectively punishing *everyone else* is an acceptable way to avoid possibly punishing any Russian citizen?

Who, specifically, will be punished by reverting this Xsnow feature?

> Because that's the other side of your very-much-hypothetical question.

There is nothing hypothetical there. Please try to explain your thoughts more clearly.

Bug of feature?

Posted Jul 2, 2026 12:58 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (2 responses)

> Do you believe in collectively punishing *everyone else* is an acceptable way to avoid possibly punishing any Russian citizen?

To be clear, removing a ukrainian flag from a software that is supposed to show christmas decorations doesn't punish anyone.

I've never heard of anyone that coming December takes out the box with the Ukrainian flags.

Do you know such a person to exist?

Bug of feature?

Posted Jul 2, 2026 13:27 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

> To be clear, removing a ukrainian flag from a software that is supposed to show christmas decorations doesn't punish anyone.

What if those folks wanted that feature and are now deprived of the pleasure of using it? Yes, it's a very light punishment, but so what?

At best, this entire conversation is effectively just a watered-down variant of the classic "who is more important" trolley problem. At worst, it treats the aggressor and targets of a brutal war as morally equivalent.

Let's stop here

Posted Jul 2, 2026 14:10 UTC (Thu) by jzb (editor, #7867) [Link]

At this point I think we've reached the point where no minds are being changed and no new information is on offer. Let's move on, please.

Bug of feature?

Posted Jul 2, 2026 14:10 UTC (Thu) by zdzichu (subscriber, #17118) [Link] (1 responses)

Yes. Next question?

Or maybe not. Your username looks russian, so you are probably not impartial.

Stop now

Posted Jul 2, 2026 14:13 UTC (Thu) by jzb (editor, #7867) [Link]

It's obvious that this is no longer a productive conversation. Let's end it here. No further replies to this, please.