Debian

The proposal argues that uncertain licensing, error-prone output, reviewer burden, and scraping-driven infrastructure costs conflict with Debian’s stability and community values. It excludes upstream projects using LLMs, but would cover Debian’s own software, web resources, documentation, and translations.

HN’s most useful response was practical: instead of asking whether a tool was involved, ask what a maintainer is personally prepared to certify and support.

The mechanism at issue is cryptsetup's luksSuspend, which is supposed to scrub the master key from memory before sleep. The claim: it quietly stopped, leaving the key resident and, in the post's words, 'for the taking by anyone who seized the still-powered laptop.'

The thread's corrections matter as much as the bug. Several readers noted luksSuspend is a Debian extension, so the headline overstates a kernel-wide flaw. Others questioned the threat model — a locked laptop isn't trivially readable by 'anyone' — and the most practical fix offered was to hibernate: power the RAM off and the whole class of cold-boot attack goes away.

The xsnow screensaver's maintainer added code that shows a Ukrainian flag at 30% probability for Russian-locale users, versus 2% for others. A complaint calling it discrimination misfired: the DFSG governs licenses, not behaviour.

Russ Allbery flagged the real worry: software that secretly changes behaviour by locale. The thread's flip, from a Debian dev: the flag already appeared at random; the patch only changed the odds.

The trigger was age-verification: when that law was 'cooking' and systemd added a field for it, Cordova decided the init system had outgrown its job. His swap command tried to purge systemd and install OpenRC in one chained step — and one reader spotted that if the purge half-fails, OpenRC never installs.

A second voice cut deeper: OpenRC hands back dependency ordering, crash supervision, and cgroup resource accounting as your problem. That, not the install, is the real work.