On Fri, Oct 23, 2026 at 09:28:08AM -0400, Theodore Tso wrote: > > > Ok, I appreciate all the feedback and reviews from this community. Still > > > I feel that the review from Theodore Tso is highly biased, and I think > > > this is because Theodore Tso is employed by Google, which makes a > > > competing web browser, Google Chrome. Therefore in my opinion the > > > Nordstjernen web browser was not given a fair chance by the Debian > > > community, and I will focus on other Linux distributions which does not > > > have Google-/corporate-biases like Debian does in this instance. >
All communications on Debian-controlled media need to be made in light of the Debian Code of Conduct and the associated mailing list Code of Conduct. I think there's something here in the expectation of what having a package in Debian actually means. Debian *isn't* a commercial distribution with commercial priorities - it is very much a community of individuals with individual perceptions, putting in (primarily) volunteer work and working together to make the whole distribution work. In order to get a new application into Debian, it's necessary to have a maintainer. There's a progression through unstable and testing into stable - you can't just "get" an application into stable from nothing. If you want to get an application into a stable release of Debian ab initio, it might take months or years (depending on the state of the release cycle). Debian relies on knowledge of who's contributing - someone arriving sight-unseen from outside Debian and asking for a package to be included is unusual. If someone is an upstream developer, then it is useful to have a collaborator within Debian working as a packager to triage bugs, pass information back to you and work with you. If the upstream coder also wants to act as a Debian packager, that's also fine but you'll need to go through an acceptance process, get a key into the Debian keyring and so on. That's where Debian mentors and working with others already within Debian is really helpful. The code needs to be appropriate for Debian in other ways: there needs to be code that people can understand, it needs to be appropriately licensed and under an appropriate copyright. A large codebase - like a web browser - will need an amount of work. Firefox and Chromium have been given special security treatment as a significant exception because the upstreams update extremely quickly and have significant security issues that are continuously being fixed: Debian primarily provides a wrapper round upstream code here and distributes this with upstream agreement. Having a package in Debian is not a guaranteed right: every package in the distribution has a maintenance cost and places an obligation on someone to support it. That's difficult to appreciate from outside - that's possibly something that we as a community need to publicise better. > ObDisclaimer: These are my views, not Google's. I don't speak for > Google and I'm not important enough and my pay scale is **way** below > the level where my views == Google's views. :-) > <snip> > Secondly, one of the reasons why I ran this security analysis was > because I was concerned that this could have been a supply chain > attack on Debian, ala the Jia Tan / XZ Utils backdoor attack. A > vibe-coded browser appearing out of nowhere, written in C which could > trivially hide all sorts of "accidental" memory pointer bugs that > could be used to remotely compromise Debian users? This raised a lot > of red flags, especially after I spent about five minutes looking at > the Git repo. > This risk of supply chain attack is a concern not *just* to Debian but to every Linux distribution at the moment - this is not exceptionalism here. <snip> > In the hope that this helps mutual understanding, this is written on behalf of the Community Team because we've had aspects of this thread drawn to our attention. With luck, this will also help clarify wider understanding of how Debian works and the expectations behind contribution of a package to Debian, as well as how continuing contribution should work within Debian once a package is included. With every good wish Andrew Cater ([email protected]) [For the Debian Community Team] > > Cheers, > > - Ted >
signature.asc
Description: PGP signature
