Following the recent discussion around the Debian decision to ship KeePassXC without any of its optional modules, we've seen some extreme misconceptions floating around the internet regarding what the WITH_XC_NETWORKING=OFF compile flag actually does.
Let us be clear: KeePassXC does NOT "randomly" connect to the internet in the background, regardless of whether you build with the flag on or off. Claims to the contrary of KeePassXC "surfing in the background" or "calling home" are false.
That's it. That's all that is removed from your build when you disable the flag. There is no web server running or anything, it's only client code requiring a manual action that is removed (as well as a link dependency to OpenSSL, which may be more significant).
What this flag DOES NOT do is sandbox KeePassXC in any way. It will also not remove Qt's internal networking modules, since these are still required for certain offline functionality such as URL parsing and local sockets (blame Qt for not separating this functionality). It will also not prevent a local attacker from loading other DLLs/SOs/DYLIBs containing network code at runtime.
@keepassxc People that were going to fearmonger about this are not going to be stopped because of your wall of text. They will still say "THING BAD" without understanding what they're saying.
@Arcaik@vintprox@keepassxc understood. But normal users are confused and from user perspective this is a bug, suddenly features are not working anymore.
Add comment