Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bug#819703: xscreensaver: please disable "This version of XScreenSaver is very old! Please upgrade!" message

443 views
Skip to first unread message

Daniel Shahaf

unread,
Mar 31, 2016, 11:10:02 PM3/31/16
to
Package: xscreensaver
Version: 5.34-1
Severity: normal
Tags: upstream patch

Dear Maintainer,

In the lock screen, XScreenSaver displays the following message in bold font:

This version of XScreenSaver is very old! Please upgrade!

There is a similar warning when opening the "Screensaver" command from
the XFCE Applications Menu:

_("Warning:\n\n"
"This version of xscreensaver is VERY OLD!\n"
"Please upgrade!\n"
"\n"
"http://www.jwz.org/xscreensaver/\n"
"\n"
"(If this is the latest version that your distro ships, then\n"
"your distro is doing you a disservice. Build from source.)\n"
),

Please disable these warnings.

A proposed (untested) patch attached.

I know that the author has placed a Big Fat Warning in senescent_p()
asking distro maintainers not to remove those warnings. However, as
a user I find these warnings rude and obnoxious, and I wish my computer
not to be obnoxious to me. Therefore, I ask that you disable the
recency check, notwithstanding the author's request.

The author's wishes that users not bother him with bugs about old
versions of the software can surely be addressed without unavoidable
dialogs in *bold* or ALL CAPS presented _every time a user unlocks her
screensaver_, as well as every time a user tries to configure her
screensaver. I can think of at least two ways off the top of my head¹,
that don't involve discrediting xscreensaver's downstreams or shouting
at users.

Thank you.

Daniel

¹ - include the release date, advice to upgrade, and a statement that
upstream won't accept bug reports, all rendered in the typical running
text font, wherever the version number is displayed; or
- route users' bug reports to upstream through a web page that
explains the issue; or
- route users' bug reports to upstream through a web form that has
a "Version number:" field and gives the "Out of date" error if the
user filled in an old version number.

P.S. I'm reporting this against the version in stable/jessie, but as far
as I can tell, the problem still exists in git revision debian/5.33-1-4-gff0d1d4.
patch.txt

Jamie Zawinski

unread,
Apr 1, 2016, 12:40:02 AM4/1/16
to
In the time it took me to read your whine, you could have upgraded your incredibly-out-of-date computer and saved us all the grief.

> However, as a user I find these warnings rude and obnoxious, and I wish my computer not to be obnoxious to me.

I find your request to be obnoxious and I wish to not have read it, but sadly we don't always get what we want.

--
Jamie Zawinski https://www.jwz.org/ https://www.dnalounge.com/

Axel Beckert

unread,
Apr 1, 2016, 4:00:03 AM4/1/16
to
Control: found -1 5.30-1

Hi,

Daniel Shahaf wrote:
> In the lock screen, XScreenSaver displays the following message in bold font:
>
> This version of XScreenSaver is very old! Please upgrade!

Indeed. Very annoying. Upstream obviously hasn't understood how
distributions work and what stable releases are.

> A proposed (untested) patch attached.

Tormod: Please fix this issue also in Debian Jessie via
jessie-proposed-updates where it probably annoys end users the most.

> I know that the author has placed a Big Fat Warning in senescent_p()
> asking distro maintainers not to remove those warnings. However, as
> a user I find these warnings rude and obnoxious, and I wish my computer
> not to be obnoxious to me. Therefore, I ask that you disable the
> recency check, notwithstanding the author's request.

I second this.

> The author's wishes that users not bother him with bugs about old
> versions of the software can surely be addressed without unavoidable
> dialogs in *bold* or ALL CAPS presented _every time a user unlocks her
> screensaver_, as well as every time a user tries to configure her
> screensaver.

That won't help. It will primarily help to scare people away from
software with stubborn upstream maintainers as it has happened in the
past with e.g. ion3 (stubborn license), micq (stating disagreement
between upstream and packager to users).

> น - include the release date, advice to upgrade, and a statement that
> upstream won't accept bug reports, all rendered in the typical running
> text font, wherever the version number is displayed; or

I don't think "advice to upgrade" is much better than the current
situation, except that it doesn't involve CAPS-LOCK and exclamation
marks.

> - route users' bug reports to upstream through a web page that
> explains the issue; or
> - route users' bug reports to upstream through a web form that has
> a "Version number:" field and gives the "Out of date" error if the
> user filled in an old version number.

That sounds like sane solutions for upstream. Nevertheless, that
doesn't solve our problem in Debian and its downstream distributions.

> P.S. I'm reporting this against the version in stable/jessie,

Sorry, you didn't. I've added the version (initially) in Jessie now.

> diff --git a/driver/prefs.c b/driver/prefs.c
> index 55bac7b..f9f96c3 100644
> --- a/driver/prefs.c
> +++ b/driver/prefs.c
> @@ -1663,6 +1663,8 @@ stop_the_insanity (saver_preferences *p)
> Bool
> senescent_p (void)
> {
> + return 0;
> +
> /* If you are in here because you're planning on disabling this warning
> before redistributing my software, please don't.

That doesn't fix the XFCE menu warning, too, right?

Regards, Axel
--
,''`. | Axel Beckert <a...@debian.org>, http://people.debian.org/~abe/
: :' : | Debian Developer, ftp.ch.debian.org Admin
`. `' | 4096R: 2517 B724 C5F6 CA99 5329 6E61 2FF9 CD59 6126 16B5
`- | 1024D: F067 EA27 26B9 C3FC 1486 202E C09E 1D89 9593 0EDE

Roberto

unread,
Apr 1, 2016, 7:10:04 AM4/1/16
to
It is not a joke, I've also noticed the message today, I was writing a
but report when I've noticed it was already reported. Since today
xscreensaver tells debian users that "your distro is doing you a

Richard Jasmin

unread,
Apr 1, 2016, 8:00:03 AM4/1/16
to
Package: xscreensaver
Version: 5.30-1+deb8u1
Followup-For: Bug #819703

Dear Maintainer,

I have a better solution.
Dispense with the horse shit.

Either provide a upstream version to be packaged(and backported) or permanently
remove the offending code(and warnings).

and as per upstream:
needs to be backported or pushed into updates server. both may be options, but
when selected the updates are EXPECTED.
At least this update is NOT PRESENT.

Thats a packaging fault.
I know of QT5(core) and Mono (v4) updates missing also.
And debs are available, so dont gimmie that line.

Nobody asked for acenine response from ANY dev, and surely such is COMPLETELY
unwarranted. If you want your package included
in distributions, make the concessions necessary to maintain the codebase with
said.

Otherwise, either DONT OFFER the code, or DONT package it further.
Drop it from the repos if the maintainer wont comply.

That should be a debian core policy.
I know several here are also acenine (with reports) or are acenine C devs that
dont give a flying eff about anyone, but thats the wrong mentality to take
with anyone. More than half of the time said acenine devs have no clue what
they are coding.

Yes, I can put my code where my mouth is, despite my unpopular view on C.

Clearly bug reports and handling is yall policy, but being the nature of "whats
and whos" involved these reports should be taken more seriously
than frivious borsht.Its not about liking the bug reporter, its about dealing
with the bug. Maybe its not so serious, MAYBE ITS WORSE.
Clearly someone needs to get thier ass in gear.



-- System Information:
Debian Release: 8.3
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages xscreensaver depends on:
ii libatk1.0-0 2.14.0-1
ii libc6 2.19-18+deb8u3
ii libcairo2 1.14.0-2.1
ii libfontconfig1 2.11.0-6.3
ii libfreetype6 2.5.2-3+deb8u1
ii libgdk-pixbuf2.0-0 2.31.1-2+deb8u4
ii libglade2-0 1:2.6.4-2
ii libglib2.0-0 2.42.1-1
ii libgtk2.0-0 2.24.25-3
ii libice6 2:1.0.9-1+b1
ii libpam0g 1.1.8-3.1+deb8u1
ii libpango-1.0-0 1.36.8-3
ii libpangocairo-1.0-0 1.36.8-3
ii libpangoft2-1.0-0 1.36.8-3
ii libsm6 2:1.2.2-1+b1
ii libx11-6 2:1.6.2-3
ii libxext6 2:1.3.3-1
ii libxi6 2:1.7.4-1+b2
ii libxinerama1 2:1.1.3-1+b1
ii libxml2 2.9.1+dfsg1-5+deb8u1
ii libxmu6 2:1.1.2-1
ii libxpm4 1:3.5.11-1+b1
ii libxrandr2 2:1.4.2-1+b1
ii libxrender1 1:0.9.8-1+b1
ii libxt6 1:1.1.4-1+b1
ii libxxf86vm1 1:1.1.3-1+b1
ii xscreensaver-data 5.30-1+deb8u1

Versions of packages xscreensaver recommends:
ii libjpeg-turbo-progs [libjpeg-progs] 1:1.3.1-12
ii perl [perl5] 5.20.2-3+deb8u4
ii wamerican [wordlist] 7.1-1

Versions of packages xscreensaver suggests:
ii chromium [www-browser] 49.0.2623.108-1~deb8u1
ii dillo [www-browser] 3.0.4-2+b1
ii elinks [www-browser] 0.12~pre6-5+b2
ii fortune-mod [fortune] 1:1.99.1-7
pn gdm3 | kdm-gdmcompat <none>
ii iceweasel [www-browser] 38.7.1esr-1~deb8u1
ii konqueror [www-browser] 4:4.14.2-1
ii links2 [www-browser] 2.8-2+b3
ii lynx-cur [www-browser] 2.8.9dev1-2+deb8u1
ii opera-stable [www-browser] 36.0.2130.46
pn qcam | streamer <none>
ii w3m [www-browser] 0.5.3-19
pn xdaliclock <none>
pn xfishtank <none>
ii xscreensaver-gl 5.30-1+deb8u1

-- no debconf information

Santiago Vila

unread,
Apr 1, 2016, 8:50:02 AM4/1/16
to
Hello.

At the risk of stating the obvious, I'm going to reply to this message
from the author, since it seems he reads the bugs reported to Debian.

On Thu, 31 Mar 2016, Jamie Zawinski wrote:

> In the time it took me to read your whine, you could have upgraded
> your incredibly-out-of-date computer and saved us all the grief.

Actually, that's not necessarily the case.

Packages in Debian stable only change when they have security bugs
(via security.debian.org), or (in certain cases) bugs of serious
severity, of the type that make them unsuitable for release.

Just "being old" is not a bug in itself, so it's not a reason good
enough to upgrade, or a reason to ask the user that he/she has
to upgrade.


Upgrading *all* the packages in Debian is quite easy: "apt-get upgrade".
You are absolutely right that it would take very little time to do
that, but not so right if you blidnly assume that a new package
somehow "has" to be available when doing "apt-get upgrade" when you
are using Debian stable.

Because stable is frozen and does not change except for security fixes
and very serious bugs.

Now, let's see what's wrong with old versions.

If you don't want to receive bugs about old versions, we understand
that completely. We don't like to receive bugs about old versions
either. The perfect bug submitter is the one that looks for the latest
version to confirm that it's not fixed yet.

To not bother upstream authors with reports about old versions, we
have our own bug tracking system. In theory, bugs about old versions
would never be forwarded to the author (via email, I mean).

> I find your request to be obnoxious and I wish to not have read it,
> but sadly we don't always get what we want.

If, as it seems, the author voluntarily subscribes to our bug tracking
system to receive all the bugs reported to Debian, that's fine
(in fact, the best upstream maintainers are the ones that do that).

But you can't then complain that you have to read bugs about old
version, that would be quite contradictory indeed.

Subscribing to a package or to a bug is like a mailing list, it's
either all or nothing.

If bugs about old version really bother you, you could just ignore
them. Nobody will ask you to fix something that it's already fixed.


Now, let's see why this warning message is not the way to go.

I have more than 1300 packages installed in the system, and I suspect
that most Debian users have a lot more.

If each and every of those packages sent me a warning just because
they are "old", Debian stable would become unusable and definitely not
nice.

And we don't want that, so I also second that this warning message
should be removed from the version in stable as well.

Thanks.

Samuel Thibault

unread,
Apr 1, 2016, 12:20:02 PM4/1/16
to
Jamie Zawinski, on Thu 31 Mar 2016 21:24:11 -0700, wrote:
> In the time it took me to read your whine, you could have upgraded your incredibly-out-of-date computer and saved us all the grief.

Incredibly-out-of-date?

I have hit the same exact bug this morning, while installing Debian
Jessie, which is the latest Debian stable release. It comes with version
5.30 of xscreensaver, which was released in september 2014, not even 2
years ago... If you consider 2 years "incredibly-out of date", then do
not follow Debian bugs, since Debian is released about every 2 years...

As said in another mail in the thread, Debian users are supposed to
report bugs to the Debian BTS, to save you the old-bug reports. Then
it's up to Debian to backport whatever fix is needed if it feels to,
without upstream being involved at all.

The current check in the source code is 18 months, perhaps Debian could
patch it to raise it to 30 months, to cover the stable freeze+release
period?

Samuel

Samuel Thibault

unread,
Apr 1, 2016, 12:20:02 PM4/1/16
to
Samuel Thibault, on Fri 01 Apr 2016 18:09:53 +0200, wrote:
> I have hit the same exact bug this morning, while installing Debian
> Jessie, which is the latest Debian stable release.

(That gives a really bad impression: Jessie is just one year old, we
told the installer to install the XFCE desktop, and the first thing we
got after rebooting from the installer was that fat warning...)

Samuel

Alexander Gerasiov

unread,
Apr 1, 2016, 12:40:03 PM4/1/16
to
Hello Samuel,

On Fri, 1 Apr 2016 18:09:53 +0200
Samuel Thibault <sthi...@debian.org> wrote:

> The current check in the source code is 18 months, perhaps Debian
> could patch it to raise it to 30 months, to cover the stable
> freeze+release period?

As for me, I'd suggest to turn this check off at all.

--
Best regards,
Alexander Gerasiov

Contacts:
e-mail: g...@cs.msu.su Homepage: http://gerasiov.net Skype: gerasiov
PGP fingerprint: 04B5 9D90 DF7C C2AB CD49 BAEA CA87 E9E8 2AAC 33F1

Michael Biebl

unread,
Apr 1, 2016, 1:00:05 PM4/1/16
to
On Fri, 1 Apr 2016 18:11:15 +0200 Samuel Thibault <sthi...@debian.org>
wrote:
Maybe the best course of action would be, if xfce didn't install
xscreensaver by default (but would choose a more lightweight / better
integrated alternative).


--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

signature.asc

Jamie Zawinski

unread,
Apr 1, 2016, 1:20:04 PM4/1/16
to
For those of you who can't be bothered to read the code, here's what the comment says.

I stand by my words here: If you are considering removing this warning, then I ask that instead, you remove the XScreenSaver software from Debian entirely. I believe Gnome-Screensaver will be more to your liking anyway.



/* If you are in here because you're planning on disabling this warning
before redistributing my software, please don't.

I sincerely request that you do one of the following:

1: leave this code intact and this warning in place, -OR-

2: Remove xscreensaver from your distribution.

I would seriously prefer that you not distribute my software at all
than that you distribute one version and then never update it for
years.

I am *constantly* getting email from users reporting bugs that have
been fixed for literally years who have no idea that the software
they are running is years out of date. Yes, it would be great if we
lived in the ideal world where people checked that they were running
the latest release before they report a bug, but we don't. To most
people, "running the latest release" is synonymous with "running the
latest release that my distro packages for me."

When they even bother to tell me what version they're running, I
say, "That version is three years old!", and they say "But this is
the latest version my distro ships". Then I say, "your distro
sucks", and they say "but I don't know how to compile from source,
herp derp I eat paste", and *everybody* goes away unhappy.

It wastes an enormous amount of my time, and kind of makes me regret
ever having released this software in the first place.

So seriously. I ask that if you're planning on disabling this
obsolescence warning, that you instead just remove xscreensaver from
your distro entirely. Everybody will be happier that way. Check
out gnome-screensaver instead, I understand it's really nice.

Of course, my license allows you to ignore me and do whatever the
fuck you want, but as the author, I hope you will have the common
courtesy of complying with my request.

Thank you!

jwz, 2014
*/

Yves-Alexis Perez

unread,
Apr 1, 2016, 3:40:03 PM4/1/16
to
On ven., 2016-04-01 at 18:54 +0200, Michael Biebl wrote:
> On Fri, 1 Apr 2016 18:11:15 +0200 Samuel Thibault <sthi...@debian.org>
> wrote:
> >
> > Samuel Thibault, on Fri 01 Apr 2016 18:09:53 +0200, wrote:
> > >
> > > I have hit the same exact bug this morning, while installing Debian
> > > Jessie, which is the latest Debian stable release.
> > (That gives a really bad impression: Jessie is just one year old, we
> > told the installer to install the XFCE desktop, and the first thing we
> > got after rebooting from the installer was that fat warning...)
> Maybe the best course of action would be, if xfce didn't install
> xscreensaver by default (but would choose a more lightweight / better
> integrated alternative).
>
That's definitely something to consider for stretch. I wasn't really willing
to do that before because without having an Xfce locker I preferred staying
with the common ground, but I also had bad interaction with the upstream
developer and am not really interested in having more interactions.

Right now, there's a way to switch to something else, which is light-locker,
so it might be a good idea to do that indeed. I'll update the tasksel package
with that in mind.

Regards,
--
Yves-Alexis

signature.asc

Michael Biebl

unread,
Apr 1, 2016, 4:40:03 PM4/1/16
to
On Fri, 1 Apr 2016 10:10:40 -0700 Jamie Zawinski <j...@jwz.org> wrote:
> For those of you who can't be bothered to read the code, here's what the comment says.
>
> I stand by my words here: If you are considering removing this warning, then I ask that instead, you remove the XScreenSaver software from Debian entirely. I believe Gnome-Screensaver will be more to your liking anyway.

Sounds like we should do that indeed.
CCing our ftp-masters.
signature.asc

Adam Borowski

unread,
Apr 1, 2016, 4:40:03 PM4/1/16
to
On Fri, Apr 01, 2016 at 09:26:23PM +0200, Yves-Alexis Perez wrote:
> On ven., 2016-04-01 at 18:54 +0200, Michael Biebl wrote:
> > On Fri, 1 Apr 2016 18:11:15 +0200 Samuel Thibault <sthi...@debian.org>
> > > (That gives a really bad impression: Jessie is just one year old, we
> > > told the installer to install the XFCE desktop, and the first thing we
> > > got after rebooting from the installer was that fat warning...)

I wonder, perhaps this could warrant pushing an expedited update somehow? A
popup blocking Xsession startup on every login shows Debian in a pretty bad
light. Yeah, it's not a data-loss bug merely a bad PR bug but still...

> > Maybe the best course of action would be, if xfce didn't install
> > xscreensaver by default (but would choose a more lightweight / better
> > integrated alternative).
>
> That's definitely something to consider for stretch. I wasn't really willing
> to do that before because without having an Xfce locker I preferred staying
> with the common ground, but I also had bad interaction with the upstream
> developer and am not really interested in having more interactions.
>
> Right now, there's a way to switch to something else, which is light-locker,
> so it might be a good idea to do that indeed. I'll update the tasksel package
> with that in mind.

light-locker has a hard dependency on lightdm, and if I read its description
right, it's impossible to remove. I don't think we should tie xfce to a
single display manager. It also does weird VT switching that's
disconcerting enough to be called a bug.

I took a look at alternatives:
* gnome-screensaver has OMGWTFBBQ-level insanity that makes it useless for
anyone but Gnome3 lovers
* mate-screensaver isn't that much better (jwz is quite right...)
* cinnamon-screensaver is surprisingly sane. Its depends/recommends would
need trimming for reasonable use outside Cinnamon but I guess that's a
matter of asking Cinnamon guys nicely. After all, it wasn't envisioned
to be used elsewhere...
* i3lock and slock[suckless-tools] lack a GUI

Another option could be forking xscreensaver, it could use some trimming and
fixing (for things where jwz disagreed). (I don't volunteer here, though --
I see a bunch of things I could help with drive-by patching, but no full
maintenance, as I don't know xlib, details of DPMS handling or such).

So, other than the obvious "return 0;" fix in jessie, I'd recommend not
being hasty and think things through before updating all tasks, etc.


Meow!
--
A tit a day keeps the vet away.

Paul R. Tagliamonte

unread,
Apr 1, 2016, 4:50:03 PM4/1/16
to
Sadsies. xscreensaver is my screensaver of choice.

Sounds fine, let's file a RoM

Cheers,
  Paul
--
:wq

Yves-Alexis Perez

unread,
Apr 1, 2016, 6:00:05 PM4/1/16
to
[note: if you don't CC: me, then I don't get your mail]

On Fri, 1 Apr 2016 22:33:31 +0200 Adam Borowski <kilo...@angband.pl> wrote:
> On Fri, Apr 01, 2016 at 09:26:23PM +0200, Yves-Alexis Perez wrote:
> > That's definitely something to consider for stretch. I wasn't really willing
> > to do that before because without having an Xfce locker I preferred staying
> > with the common ground, but I also had bad interaction with the upstream
> > developer and am not really interested in having more interactions.
> > 
> > Right now, there's a way to switch to something else, which is light-locker,
> > so it might be a good idea to do that indeed. I'll update the tasksel package
> > with that in mind.

> light-locker has a hard dependency on lightdm, and if I read its description
> right, it's impossible to remove.  I don't think we should tie xfce to a
> single display manager.  It also does weird VT switching that's
> disconcerting enough to be called a bug.

Xfce is not tied to lightdm or light-locker. Current situation is:

- task-xfce-desktop depends on xfce4, lightdm
- xfce4 depends on xfce4-session
- xfce4-session recommends xscreensaver

I've switched that (for stretch) to:

- task-xfce-desktop depends on xfce4, lightdm, light-locker
- xfce4 depends on xfce4-session
- xfce4-session recommends light-locker

So you'll have lightdm + light-locker by default when you select Xfce desktop
when installing, but you can remove it and if you manually install xfce4 and
don't install recommends you won't have it either.

Regards,
--
Yves-Alexis

signature.asc

Daniel Shahaf

unread,
Apr 1, 2016, 11:00:03 PM4/1/16
to
Control: found -1 5.30-1+deb8u1
Control: notfound -1 5.34-1

Axel Beckert wrote on Fri, Apr 01, 2016 at 09:54:39 +0200:
> Daniel Shahaf wrote:
> > P.S. I'm reporting this against the version in stable/jessie,
>
> Sorry, you didn't. I've added the version (initially) in Jessie now.

Good catch, thank you. I observed the prompts in the jessie-security
version but did not test the sid version; metadata updated accordingly.

> > diff --git a/driver/prefs.c b/driver/prefs.c
> > index 55bac7b..f9f96c3 100644
> > --- a/driver/prefs.c
> > +++ b/driver/prefs.c
> > @@ -1663,6 +1663,8 @@ stop_the_insanity (saver_preferences *p)
> > Bool
> > senescent_p (void)
> > {
> > + return 0;
> > +
> > /* If you are in here because you're planning on disabling this warning
> > before redistributing my software, please don't.
>
> That doesn't fix the XFCE menu warning, too, right?

For future reference, this patch eliminates both of the prompts the
original report mentions. (senescent_p() must return true for any of
the warnings to be displayed.)

To clarify: I'm simply stating a technical fact about the patch; I'm not
advocating one way or the other regarding whether the package should be
removed from stretch, since that's a political issue, as opposed
a technical one. (jwz: the package cannot be removed from jessie and
earlier; it can only be removed from stretch and later.)

That said, for what it's worth, I think it would be unfortunate if the
package is removed from stretch: I run stable, it's a tradeoff
I consciously made, and there is no reason for me to be barred from
using software written by people who use their computers differently
than I do.

Cheers,

Daniel
(I wonder if I would be able to continue using unicode-screensaver under
light-locker, should xscreensaver be removed...)

Holger Levsen

unread,
Apr 1, 2016, 11:10:03 PM4/1/16
to
Hi,

On Sat, Apr 02, 2016 at 02:53:30AM +0000, Daniel Shahaf wrote:
> Control: notfound -1 5.34-1

the bug is present in that version. The timebomb just hasn't been triggered
yet.

(Also for fixing this in stable (and oldstable) it needs to be fixed / not be
present in unstable first.)


--
cheers,
Holger
signature.asc

Daniel Shahaf

unread,
Apr 1, 2016, 11:20:03 PM4/1/16
to
Control: found -1 5.34-1

Holger Levsen wrote on Fri, Apr 01, 2016 at 23:04:28 -0400:
> Hi,
>
> On Sat, Apr 02, 2016 at 02:53:30AM +0000, Daniel Shahaf wrote:
> > Control: notfound -1 5.34-1
>
> the bug is present in that version. The timebomb just hasn't been triggered
> yet.

Okay; metadata restored. (I had removed it because I had only confirmed
5.34-1 was affected by code inspection, as opposed to compiling/running
it and observing the message being displayed.)

Thanks,

Daniel

Adam Borowski

unread,
Apr 1, 2016, 11:40:03 PM4/1/16
to
On Fri, Apr 01, 2016 at 11:04:28PM -0400, Holger Levsen wrote:
> On Sat, Apr 02, 2016 at 02:53:30AM +0000, Daniel Shahaf wrote:
> > Control: notfound -1 5.34-1
>
> the bug is present in that version. The timebomb just hasn't been triggered
> yet.

For the record, the timebomb for 5.34 will go off on 2017-04-01, ie, shortly
after stretch's expected release date.

> (Also for fixing this in stable it needs to be fixed / not be present in
> unstable first.)

Why? The fix is a trivial technical matter (Daniel's one-line patch in the
very first mail) and no one questions what to do for stable.

It's the political issue in unstable what needs deliberation. And it looks
like removal is more likely to happen than forking, so the problem might
be never fixed in unstable.

> and oldstable

The timebomb was introduced in 5.21, oldstable has 5.15, o-o-stable 5.11, so
neither is affected.

Peter Nowee

unread,
Apr 2, 2016, 12:00:03 AM4/2/16
to
I do not agree with the removal of the xscreensaver package.

Thankfully, when writing down his wish regarding this particular piece
of code, the author made sure to write that he did not mean to derogate
the user freedoms provided by the license he chose:

> Of course, my license allows you to ignore me and do whatever the
> fuck you want, but as the author, I hope you will have the common
> courtesy of complying with my request.

He just confirmed to us that he still stands by those words as well.

So, in the end, he values user freedom above his wish that we either
keep the warning or remove the software from our distribution. This
deserves our respect and gratitude.

Considering the issue at hand, I think we should exercise that user
freedom now by disabling the warning while keeping the software in our
distribution. For jessie/stable I think there is even no other choice.

At the same time, we could try to make up for not having the "common
courtesy" he expected from us. For example, we could mention "Bug
reports:" with a Debian URL above his URL in the About dialog. I think
this would greatly reduce the number of bug reports on old versions
directed to him, which he named as the main reason behind his original
wish.

I hope this policy can then be extended to keep xscreensaver in future
Debian releases as well.
signature.asc

Holger Levsen

unread,
Apr 2, 2016, 12:10:03 AM4/2/16
to
Hi,

On Sat, Apr 02, 2016 at 05:33:52AM +0200, Adam Borowski wrote:
> > (Also for fixing this in stable it needs to be fixed / not be present in
> > unstable first.)
> Why?

because that's the usual policy for fixing issues in stable, which was
also confirmed for this particular issue by a SRM on #debian-release
today.

> [...] it looks
> like removal is more likely to happen than forking, so the problem might
> be never fixed in unstable.

Removing the package from unstable will cause the bug not be present in
unstable so that's an ok solution from the POV of getting it fixed in
stable.

> The timebomb was introduced in 5.21, oldstable has 5.15, o-o-stable 5.11, so
> neither is affected.

Thanks for the clarification. (Also for checking when it will hit 5.34!)


--
cheers,
Holger
signature.asc

Jamie Zawinski

unread,
Apr 2, 2016, 12:10:03 AM4/2/16
to
Please remove XScreenSaver from Debian.

Peter Nowee, please take your sanctimony and go fuck yourself with it.

Jamie Zawinski

unread,
Apr 2, 2016, 1:40:02 AM4/2/16
to
Peter Nowee wrote:

> Was I wrong when I said that you value user freedom above your wish
> that we either keep the warning or remove your software from Debian?

Awesome, you seem to be one of those people who think "if it's legal, it must be right." That's a common toxin in the software industry these days.

I guess you want Debian to be the kind of operation that uses the work of others while blatantly and explicitly ignoring the wishes of the person who *did the actual creative work*.

Nice.

Peter Nowee

unread,
Apr 2, 2016, 1:40:03 AM4/2/16
to
On Fri, Apr 01, 2016 at 09:04:45PM -0700, Jamie Zawinski wrote:
> Please remove XScreenSaver from Debian.
>
> Peter Nowee, please take your sanctimony and go fuck yourself with it.
>

Was I wrong when I said that you value user freedom above your wish
that we either keep the warning or remove your software from Debian?

I mean, you are the one giving mixed signals here: First telling us we
can use, modify and distribute your work, then asking us to "please"
not modify this and "please" not distribute that.

Just change your license if this is really as important to you as your
cursing suggests.
signature.asc

Peter Nowee

unread,
Apr 2, 2016, 2:50:02 AM4/2/16
to
On Fri, Apr 01, 2016 at 10:37:35PM -0700, Jamie Zawinski wrote:
> Peter Nowee wrote:
>
> > Was I wrong when I said that you value user freedom above your wish
> > that we either keep the warning or remove your software from Debian?
>
> Awesome, you seem to be one of those people who think "if it's legal,
> it must be right." That's a common toxin in the software industry
> these days.
>
> I guess you want Debian to be the kind of operation that uses the
> work of others while blatantly and explicitly ignoring the wishes of
> the person who *did the actual creative work*.

No and no.

You called this upon yourself when you put in that time bomb.

With regard to stable/jessie, I propose we use our rights, but try to
make up for ignoring your wishes by trying to reduce the flow of bug
reports to you in another way, for example by the additional URL in the
About box I suggested by my earlier email. Please reconsider.

With regard to future versions of Debian, again I think you should be
more clear in your license terms. Don't pretend to publish it as free
software, but then use pretty "please", time bombs and cursing to get
users to not use their freedoms.
signature.asc

Hilko Bengen

unread,
Apr 2, 2016, 8:40:04 AM4/2/16
to
* Paul R. Tagliamonte:

> Sadsies. xscreensaver is my screensaver of choice.
>
> Sounds fine, let's file a RoM

Wouldn't it be better to first focus on the imminent problem that users
are facing? As of today, xscreensaver as shipped with jessie annoys
users and that needs to stop.

So the upstream author has shown that he enjoys being a dick and that he
can't be bothered to deal with users' bug reports against versions of
his software that he no longer wants to support. Apparently, giving
canned responses to those users takes too much of his time, while
spewing individual insults here does not.

Why should we or our users care about any of this? We should simply
patch out those stupid warnings, maybe even leave a note in
README.Debian for interested users to read, and be done with it.

I don't see a good substitute for xscreensaver in Debian at the moment:
i3lock, slock, etc. are too bare-bones and don't really work for
unexperienced users, not sure about light-locker because of the ligthdm
dependency. Please, let's not remove xscreensaver just yet: The software
itself is stable and looks otherwise perfectly maintainable for people
who can ignore the author's occasional tirade.

Cheers,
-Hilko

Axel Beckert

unread,
Apr 2, 2016, 9:30:12 AM4/2/16
to
Hi,

Paul R. Tagliamonte wrote:
> Sadsies. xscreensaver is my screensaver of choice.

Same here since xlockmore was removed due to unreliability and hence
security-relevant RC bugs.

> Sounds fine, let's file a RoM

Are you nuts? You just said, it's your favourite! Why do you want to
kill it?

Hilko Bengen wrote:
> Wouldn't it be better to first focus on the imminent problem that users
> are facing?

Definitely.

> Why should we or our users care about any of this?

We shouldn't. We should focus on the distribution _we_ want to use[0],
not on what some crazy upstreams think we should do or now.

[0] http://www.eyrie.org/~eagle/journal/2012-01/004.html

> We should simply patch out those stupid warnings, maybe even leave a
> note in README.Debian for interested users to read, and be done with
> it.

Another option which should satisfy both, upstream and users is to
offer users the choice to use a backport of xscreensaver. But I'm
personally totally fine with having an 18 months old xscreensaver in
Stable. As I am with nearly all other packages. I mean, it's Stable,
not bleeding edge.

> I don't see a good substitute for xscreensaver in Debian at the moment:
> i3lock, slock, etc. are too bare-bones and don't really work for
> unexperienced users,

And gnome-screensaver (which looks like a fork of xscreensaver) lacks
quite some features like "xscreensaver-command -watch" while adding
additional and completely unnecessary dependencies on GNOME stuff
non-GNOME users don't need.

> Please, let's not remove xscreensaver just yet:

+1

> The software itself is stable and looks otherwise perfectly
> maintainable for people who can ignore the author's occasional
> tirade.

Well, if upstream can't communicate in a sane and polite manner and
continues to write such hate mails, there's still the possibility of
banning him from the BTS.

Just because some upstream hasn't read
https://www.debian.org/doc/manuals/debian-faq/ch-choosing.en.html#s3.1.3
doesn't mean that we should remove all his packages from Debian.

Paul Tagliamonte

unread,
Apr 2, 2016, 10:00:03 AM4/2/16
to
On Sat, Apr 02, 2016 at 03:17:11PM +0200, Axel Beckert wrote:
> > Sounds fine, let's file a RoM
>
> Are you nuts? You just said, it's your favourite! Why do you want to
> kill it?

Well, yes, I am a bit nuts, but here's why.


I think we can all agree the current situation is broken. Fixes in newer
versions aren't getting backported, which means either the maintainer
isn't interested in backporting bugfixes to stable (it's a lot of work,
I understand it), or users don't report bugs to the BTS, going right
upstream, and the maintainer isn't aware of them (which might explain
why upstream is seeing bugs from users in Ubuntu and Debian).


Even if it's just from testing and the next stable release.

However, ore and more, I'm becoming a bit concerend about leaf packages
we maintain in stable that have their own release schedule, where they
do significat testing to ensure no regressions or breakages. We don't
have a good story for updating a package like this (short of backports,
but even that isn't a clear win).


This wouldn't be the first removal because an upstream isn't happy, and
it won't be the last.


At the very least, CC'ing ftpmaster@ and asking what they think, the
obvious response is "Sure, remove it".

I'm not going to tell someone with any fancy hat I might have hanging up
to maintain something against their will, or back a decision to piss off
your upstream.


So, let's make a deal. I see a two outcomes that are tolerable:

- ${BUGS} in xscreensaver get a backport to the version in stable, and
a s-p-u, and upstream tells distro users to report bugs with the distros.

- xscreensaver is removed from stable, unstable stays up to date. This
doesn't make upstream happy until next release.


The SRMs might have something to say about the first ("Is this a RC bug,
why are you backportting a papercut bug"), and I've started to become
annoyed with the second type of package.


Anyway, my two cents. This entire discussion appears to be a pit of
angry emotions and no real communication. That's a shame. So this will
be the last I'll say on this until (if?) you file a RoM. In that case,
likely dak will reply on my behalf.

Cheers,
Paul
signature.asc

Tiago Ilieve

unread,
Apr 3, 2016, 1:20:03 PM4/3/16
to
Hi Yves-Alexis,

On Fri, 01 Apr 2016 21:26:23 +0200 Yves-Alexis Perez <cor...@debian.org> wrote:
> Right now, there's a way to switch to something else, which is light-locker,
> so it might be a good idea to do that indeed. I'll update the tasksel package
> with that in mind.

Indeed. For someone who uses Xfce and rely on xscreensaver only for
locking, it's a matter of switching to light-locker and uncommenting
the line "greeter-hide-users=false" in "/etc/lightdm/lightdm.conf".
This way it behaviors in a way pretty close to the former.

Thanks for the suggestion.

Regards,
Tiago.

--
Tiago "Myhro" Ilieve
Blog: https://blog.myhro.info/
GitHub: https://github.com/myhro
LinkedIn: https://br.linkedin.com/in/myhro
Montes Claros - MG, Brasil

Peter Lawler

unread,
Apr 3, 2016, 8:50:02 PM4/3/16
to
On Fri, 1 Apr 2016 10:10:40 -0700 Jamie Zawinski wrote:
> For those of you who can't be bothered to read the code, here's what
the comment says.

<snip>

Sounds awfully a lot like this old Gentoo bug

https://bugs.gentoo.org/show_bug.cgi?id=35890

And yes, I'm probably going to hell for submitting this into the report...

Pete.

Santiago Vila

unread,
Apr 4, 2016, 11:30:02 AM4/4/16
to
On Fri, 1 Apr 2016, Jamie Zawinski wrote:

> Awesome, you seem to be one of those people who think "if it's
> legal, it must be right." That's a common toxin in the software
> industry these days.

Speaking of right and wrong:

Have you considered to change the license, so that it better reflects
what it's right and what it's wrong?

We have "main" and "non-free" sections in the repositories.

But we don't have a "morally-non-free" section for software which is
legally free to distribute, but "wrong" to modify according to the author.
[ For this reason ftpmaster will probably just remove this from Debian ].

So: What would be the problem in actually forbidding to remove the warning?

More than one copyright holder? In such case: who of them are to
decide what's "right" and what's "wrong"? It is easy to imagine that
some contributions were made on the basis that the program would be free,
both in the legal sense and the moral sense.

Thanks.

alberto fuentes

unread,
Apr 4, 2016, 3:30:03 PM4/4/16
to
On Mon, Apr 4, 2016 at 5:17 PM, Santiago Vila <san...@unex.es> wrote:
Speaking of right and wrong:

Have you considered to change the license, so that it better reflects
what it's right and what it's wrong?

Please, dont turn this into something about morale or licenses.

This is one of those rare cases that can be fixed technically.

So far, upstream just wishes not be bothered about what debian does with his software and rightfully so

He just chose a rather aggressive way to communicate the problem that debian was causing him using a nagging text

Lets just find a way where our users stop pestering him and call it a day...

This happens all the time in all the projects

Santiago Vila

unread,
Apr 4, 2016, 4:40:03 PM4/4/16
to
Hello Alberto.

On Mon, Apr 04, 2016 at 09:17:23PM +0200, alberto fuentes wrote:

> Please, dont turn this into something about morale or licenses.

I don't see the "turn". As I see it, it's a morale and licenses
problem from the beginning: The program itself is free, but the author
asks that we do not modify a certain part of it.

That would be a "moral dilemma". Usually, moral dilemmas like that are
resolved by ftpmasters removing the package from Debian.

> This is one of those rare cases that can be fixed technically.
>
> So far, upstream just wishes not be bothered about what debian does with
> his software and rightfully so

Actually, his wishes are expressed in the ten first lines of
senescent_p(). The remaining text is just the "rationale".

> He just chose a rather aggressive way to communicate the problem that
> debian was causing him using a nagging text

Well, we have the BTS. If the problem is really that he receives bugs that
(rightfully) he would prefer not to handle, we are already part of the
solution, not part of the problem.

More to the point, he even subscribed to his package in the BTS! For
an author who says he does not want to receive bug reports about old
release, that's remarkable.

So: Is Debian particularly causing him a problem by distributing
version 5.30 in Debian stable? I don't think so (but I could be wrong).

> Lets just find a way where our users stop pestering him and call it a day...
>
> This happens all the time in all the projects

Well, let FSM hear you. By reading the code and his comments, I don't
think there will be a "solution" which satisfies him and our users at
the same time.

Thanks.

Steven Chamberlain

unread,
Apr 5, 2016, 2:00:04 PM4/5/16
to
Hi,

I suggest this bug,
#819703 - xscreensaver: please disable "This version of XScreenSaver is very old! Please upgrade!" message
only be used to discuss that issue and how to fix it in stable.

To anyone else waiting for that to be fixed in the package, please be
patient for the maintainer to respond about the patch in
https://bugs.debian.org/819703#5, or otherwise for someone else to
do an NMU.

I've filed a separate bug,
#820105 - xscreensaver: please consider removal from sid
regarding the upstream maintainer's request for Debian to stop
distributing xscreensaver, and other concerns about carrying it in
future Debian stable releases.

And there already was a bug,
#802914 - xscreensaver: CVE-2015-8025: crash when hot-swapping monitors while locked
where that security issue was discussed, and backported to Debian
squeeze-lts, wheezy and jessie a long time ago.

Thanks,
Regards,
--
Steven Chamberlain
ste...@pyro.eu.org
signature.asc

Tormod Volden

unread,
Apr 5, 2016, 2:40:03 PM4/5/16
to
Thanks to Michael (and others?) for providing patches, generally the
most valuable contribution in a bug report.

Jamie, you could have deleted all e-mail reports from Debian users in
the time it took you to write this Easter egg :)

(Just responding to the productive participants first, since this may get long)

Please calm down people, a little pop-up and an extra click is
annoying but it is not the end of the world. The pop-up message may be
direct, but is it not attacking any minorities, genders or sexual
preferences. There is no need for name calling and disrespectful talk
here. Especially the Debian contributors around should know there is a
code of conduct that should be followed here in bug reports as in any
other Debian activity. If you are not contributing, but are here to
whine or me-too, your presence is not needed or helpful, so please go
back to fecebook/riddit. Also know that any changes to the stable
distribution is a long and difficult process, so patience is needed by
all parties.

There is often a lack of respect, consideration and gratitude towards
the upstream author of software. Creating the software and generating
original content is the hardest and most meritable part. It seems some
people feel entitled just because they are repackaging software or
even are being able to install it. Jamie has done a phenomenal job of
creating and improving XScreenSaver, and gives it away for free to us
to use and modify as we want, what more can one ask for? He is also an
exemplary upstream in that he follows the xscreensaver bug tracker in
Debian, and often comments on bug reports. We are grateful for this
and wishes more upstreams would do the same. Granted, the bug
reporters don't always get to hear what they wanted :) but overall it
is a privilege to have direct communication with the original software
creator.

It is understandable that upstreams are frustrated by seeing users
stuck with older versions. It is sometimes frustrating for the
packagers too, and the users. However it is the way a stable
distribution works. The concept of stable releases is not unknown to
the Jamie either, in fact he gives no access to any development
repository or snapshots of XScreenSaver, and sometimes takes long
between his releases. Version 5.30, which he hates us for having in
stable, was still the latest release but already almost a year old
when we entered the freeze at that time. If you look at the upstream
changelog, the changes since then up to 5.34 are minor, and heavily
focused on iOS issues that are not of interest to our users. It can be
added that the one security issue that came up last year, was fixed
immediately in squeeze and sid when we were notified. So the "old"
version in stable is not a big issue, but a small irritation for every
little fix that upstream has added later.

Now it is clear for everybody that we don't want software to suddenly
change by itself in a stable distribution. As stable distribution
users we want our software to work as it did yesterday unless we
explicitly request changes. The introduction of the present Easter egg
was an awkward gesture by the author and an oversight from our side to
let it slip in. This is a small technical issue that we can solve
easily. The author wants to make a point about our distribution of
older versions, and this is indeed a general question that should be
discussed. This is of strategical importance, but does not belong here
in this bug report.

Debian users should always report bugs to Debian and not directly
upstream. So the author being spammed by Debian users on old versions
should in principle not happen. If the current software encourages
people to send bug reports to the author we will look into and fix
this.

It is possible that I have not read all 400 comments here, but I think
I have got enough information to work on the problem. It is good to
see so many care for, and use, xscreensaver. Usually this is a quiet
place. Thanks, all.

Tormod

alberto fuentes

unread,
Apr 5, 2016, 3:30:03 PM4/5/16
to
On Tue, Apr 5, 2016 at 8:31 PM, Tormod Volden <debian...@gmail.com> wrote:
Thanks to Michael (and others?) for providing patches, generally the
most valuable contribution in a bug report.

Thanks for being a calm and sensible maintainer amidst the turmoil!

Peter Nowee

unread,
Apr 5, 2016, 7:10:03 PM4/5/16
to
On Tue, Apr 05, 2016 at 08:31:46PM +0200, Tormod Volden wrote:
> Debian users should always report bugs to Debian and not directly
> upstream. So the author being spammed by Debian users on old versions
> should in principle not happen. If the current software encourages
> people to send bug reports to the author we will look into and fix
> this.

Thanks for your reply.

Here is a patch I was working on to add links to the Debian BTS in the
several places where bug reporting is encouraged (man pages, dialog
boxes). Perhaps it can be of use. Note that I did not have a chance to
test the change I made to the Motif dialog box (driver/demo-Xm.c) yet.

Good luck, thanks,
Peter Nowee
60_bugs_to_debian_bts.patch
signature.asc

Tormod Volden

unread,
Apr 7, 2016, 3:40:04 PM4/7/16
to
On Wed, Apr 6, 2016 at 1:01 AM, Peter Nowee <pe...@peternowee.com> wrote:
> Here is a patch I was working on to add links to the Debian BTS in the
> several places where bug reporting is encouraged (man pages, dialog
> boxes). Perhaps it can be of use. Note that I did not have a chance to
> test the change I made to the Motif dialog box (driver/demo-Xm.c) yet.
>
> Good luck, thanks,
> Peter Nowee

Thanks for the patch, Peter! I have opened bug #820378 for this task.

Tormod
0 new messages