Debian Bug report logs - #792916
RFP: keybase-client -- a client to access keybase services

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jeffrey Cliff <jeffrey.cliff@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: RFP: keybase-client a client to access keybase services

Date: Mon, 20 Jul 2015 01:27:37 -0400

[Message part 1 (text/plain, inline)]

Package: wnpp
Severity: wishlist

https://github.com/keybase/node-client


Keybase is offereing an open-source (MIT/BSD-like license) client to
connect to its key management services at http://fncuwbiisyh6ak3i.onion/,
in effect trying to make GPG easier to use and easier to scale to
social-network level network effects.

[Message part 2 (text/html, inline)]

Message #16 received at 792916@bugs.debian.org (full text, mbox, reply):

From: anarcat <anarcat@debian.org>

To: Jeffrey Cliff <jeffrey.cliff@gmail.com>, 792916@bugs.debian.org

Subject: Re: Bug#792916: RFP: keybase-client a client to access keybase services

Date: Thu, 10 Mar 2016 13:10:48 -0500

[Message part 1 (text/plain, inline)]

FWIW, keybase is now written in go and the main client is here:

https://github.com/keybase/client

there's a debian package available upstream:

https://keybase.io/download
https://keybase.io/docs/the_app/install_linux

... and the source for that seems to be partly here:

https://github.com/keybase/client/tree/master/packaging/linux/deb

I am not sure keybase itself is such a good thing: they have weird
practices like encouraging people to store the private key on the server
and so on. But it's an interesting project and certainly has its place
in Debian.

a.

[signature.asc (application/pgp-signature, inline)]

Message #21 received at 792916@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: anarcat <anarcat@debian.org>, Jeffrey Cliff <jeffrey.cliff@gmail.com>, 792916@bugs.debian.org

Subject: why exactly should this crap be in Debian?

Date: Fri, 11 Mar 2016 11:23:02 +0100

Hi anarcat,

I've just read http://anarc.at/blog/2016-03-10-keybase/ and I have looked at 
keybase in more detail a year or so ago… and am puzzled to learn that you 
think that this perceptive crappy tool which is also suggesting crappy 
workflows should be packaged and shipped in Debian.

Can you explain why this would be good? For Debian? For the free software 
community?

I can understand how this is good for the company behind it…


cheers,
	Holger

Message #26 received at 792916@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: Holger Levsen <holger@layer-acht.org>, Jeffrey Cliff <jeffrey.cliff@gmail.com>, 792916@bugs.debian.org

Subject: Re: why exactly should this crap be in Debian?

Date: Fri, 11 Mar 2016 08:56:03 -0500

On 2016-03-11 05:23:02, Holger Levsen wrote:
> Hi anarcat,
>
> I've just read http://anarc.at/blog/2016-03-10-keybase/ and I have looked at 
> keybase in more detail a year or so ago… and am puzzled to learn that you 
> think that this perceptive crappy tool which is also suggesting crappy 
> workflows should be packaged and shipped in Debian.
>
> Can you explain why this would be good? For Debian? For the free software 
> community?

I think I have made it clear in the blog post, but I can reiterate here.

 * The keybase client is free software
 * Keybase helps users getting familiar with cryptographic identity and
   authentication (even though it has flaws in the ways it does even that)
 * Keybase allows to extend the web of trust by leveraging "trusted"
   social networking sites

There are numerous pieces of software in Debian that interoperate with
commercial services. We have had that debate numerous times, yet we
still allow free software that talks to Twitter, Google, Facebook and
Github, and rightly so, in my opinion.

Facebook encourages very bad privacy practices, Google surveils
everyone, and Twitter has basically become an ad-delivery system. Should
we ban all software that interact with those from Debian?

> I can understand how this is good for the company behind it…

Honestly, the company doesn't need Debian to package this - they already
have a lovely Debian package, based on the Chromium packaging (for the
auto-updater) and a absolutely delightful curl | bash pipeline on the
download page.

If our users are going to use keybase, they might as well have a more
secure way of installing it than that ridiculous tradition.

Besides, I am not pushing for anyone in particular to pick this up
here. This can stay a RFP until upstream wakes up, for example, or some
user that actually wants to fix this provides a package.

I merely commented here to point to the new client, nothing more.

A.

-- 
feature, n: a documented bug | bug, n: an undocumented feature
                        - Mario S F Ferreira <lioux@FreeBSD.org>

Message #31 received at 792916@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: 792916@bugs.debian.org

Subject: Re: why exactly should this crap be in Debian?

Date: Tue, 15 Mar 2016 20:53:11 -0400

Hi,

On Tue, Mar 15, 2016 at 08:38:50PM -0400, Antoine Beaupré wrote:
> By that standard, we should remove a *lot* of stuff from Debian.

yes, we probably should…

> And somehow, you propose we draw the line at... Keybase? Of all places,
> it seems like a weird detour to draw a line. I would totally ban
> Facebook and Google clients way before Keybase.

you have a point here.

(and my "argument" in favor is probably a weak one: lots of user demand
for those others…)
 
> Think of how much security you give up the second you fire up
> Chromium before you complain about issues in Keybase.

I haven't used Chromium since more than a year…
 
> Well, "encourages" is a big word. It asks you, and defaults to
> "yes". That is a small detail, that can be easily patched in Debian if
> we are so obstinate about it.

I actually like this idea, this detail, a lot.
 
> In other words, foot-shooting devices are plentiful in Debian. The
> alternative to Keybase, right now, is GPG, and is probably worse, by a
> few orders of magnitude, than keybase in terms of foot-shooting! I have
> seen people:
> 
>  * sign PGP keys after getting the fingerprints by email in the clear
>    without no other form of authentication
>  * lose revocation certificates
>  * loose their private GPG (and therefore access to their data and
>    previous communications)
>  * mistakenly revoke their keys by double-clicking on them (oops)
>  * mistakenly publish their private key material

point.
 
 
> All this with our so beloved GPG that we hold dear to our hearts. GPG is
> one of the worst usability nightmare in the history of crypto computing,
> yet we not only use it, but manage the whole Debian upload process and
> voting with it.
> 
> So please, foot-shooting is not an argument against new software coming
> into Debian. From what I can see, it's almost a philosophy to make
> crypto software so cryptic no one can actually use them properly without
> reading a 20 page manual.

Sadly I have to agree here too :/
 
> > Which actually can be seen as an endorsement for packaging this.
> 
> That, again, is quite a stretch. I have been very explicit in my blog
> and on Twitter that I do not endorse keybase. I don't understand why you
> misconstrue my intentions that way.

because that's what people always^woften do. (understand each other differently
than intended by the speaker…)
 
> I do not believe in Hell. :p

:-)

me neither, but I do use the figure of speech…
 
> > So I will speak up: please don't package this for Debian (as long as the
> > flaws are as they are now…), please close this RFP.
> 
> I wasn't planning on packaging this for Debian, for the record. This is
> an RFP, not an ITP, and not assigned to anyone.
> 
> I'm just the messenger.

I wasn't addressing you here, I should have probably made this more
clear.


Really thanks for your comments, they make a lot of sense to me! (Much
more than your blogpost alone.)

-- 
cheers,
	Holger

Message #36 received at 792916@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: Holger Levsen <holger@layer-acht.org>, 792916@bugs.debian.org, 792916@bugs.debian.org

Subject: Re: Bug#792916: why exactly should this crap be in Debian?

Date: Tue, 15 Mar 2016 21:34:12 -0400

On 2016-03-15 20:53:11, Holger Levsen wrote:
> I wasn't addressing you here, I should have probably made this more
> clear.

Well... you writing to me, dropping the bug report in CC, in the last
post. You re-added it in CC now, i guess that was an oversight? :)

> Really thanks for your comments, they make a lot of sense to me! (Much
> more than your blogpost alone.)

No problem, glad I could clarify.

Feel free to comment on the blog post as well.

a.
-- 
I'm sorry if any of you are catholic. I'm not sorry if you're
offended, I'm actually just sorry by the fact that you're catholic
                         - Bill Hicks

Message #41 received at 792916@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Antoine Beaupré <anarcat@debian.org>

Cc: 792916@bugs.debian.org

Subject: Re: Bug#792916: why exactly should this crap be in Debian?

Date: Tue, 15 Mar 2016 22:18:44 -0400

Hi,

On Tue, Mar 15, 2016 at 09:34:12PM -0400, Antoine Beaupré wrote:
> Well... you writing to me, dropping the bug report in CC, in the last
> post. You re-added it in CC now, i guess that was an oversight? :)

ah, yes, it was. I switched my mail client 5 days ago after 20 years of using
the "other client" and am still new to this fancy mutt thing ;-)

(I've briefly considered resending that mail to the bug report too, not
sure if it's worth it.)

> > Really thanks for your comments, they make a lot of sense to me! (Much
> > more than your blogpost alone.)
> No problem, glad I could clarify.

:)

> Feel free to comment on the blog post as well.

nah, the bug report is linked from the blog post, that should be enough…

-- 
cheers,
	Holger

Message #66 received at 792916-done@bugs.debian.org (full text, mbox, reply):

From: Jeffrey Cliff <jeffrey.cliff@gmail.com>

To: 792916-done@bugs.debian.org

Subject: no longer needed/wanted

Date: Mon, 21 Sep 2020 11:45:10 -0600

[Message part 1 (text/plain, inline)]

close 792916

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.