Xsnow 'protestware' in Debian

The xsnow application, which generates an animated snowfall effect (and other pleasant diversions) for X11 desktops, does not seem like an obvious channel for political statements. Nevertheless, xsnow's maintainer seems to have included a political protest in the program: an Easter egg that is triggered when the program's language is set to Russia ("ru"). One user has complained that this functionality should be removed from the Debian xsnow package, but Debian does not seem to have any rules that forbid such a feature outright.

#### The complaint

On June 14, Alexander Ivanov sent a message to Debian's development list to complain that if a user's language settings were set to Russian, it would trigger "a disguised visual element (Ukrainian flags labeled as 'EXTRATREE') with a significantly higher probability". The code is found in the src/scenery.c file beginning on line 326 in xsnow 3.8.3, the version packaged for Debian 13 ("trixie") and in 3.8.6, which is in unstable:

#ifdef USE_EXTRATREE if (global.Language && !strcmp(global.Language,"ru") && drand48() < 0.3) tt = MAXTREETYPE; if (drand48() < 0.02) tt = MAXTREETYPE; #endif

Xsnow is more likely to display Ukrainian flags (src/Pixmaps/extratree.xpm) if the language is set to Russian. Xsnow allows users to pick from one of several languages; when the application was set to English, I did not see any Ukrainian flags but they should pop up about 2% of the time. I did see the expected decorations such as a moon, snow, trees, polar bears, birds, and Santa with his sleigh. After I changed the language setting to Russian, xsnow immediately placed several flags on the desktop along with the other decorations. The screenshot below shows what this looks like on Debian 13.

> ![Image 4: [xsnow running on Debian Trixie]](https://static.lwn.net/images/2026/xsnow.png)

#### DFSG violation

Ivanov claimed that the behavior violated the Debian Free Software Guidelines (DFSG) that are part of the project's Social Contract. Specifically, he said that the "targeted behavior" violated the principles of no discrimination against persons or groups (DFSG #5) and no discrimination against fields of endeavor (DFSG #6).

Ivanov had not filed a bug, but was, instead reporting the problem to "the wider Debian development community". He said he took that route because the maintainer of the Debian package, Willem Vermin, is also the maintainer of the xsnow project and had been the one to introduce the change in the first place.

Chris Hofstaedtler replied that Ivanov was mistaken; the DFSG does not require that the _software_ is non-discriminatory, but that the license for the software is. "The licenses in use do not appear to violate the DFSG's points 5 or 6. Please read the DFSG carefully next time." Xsnow is primarily licensed under the GPLv3, though some files carry other Debian-approved licenses.

> **No AI slop, all substance: subscribe to LWN today**

> LWN has always been about quality over quantity; we need your help to continue publishing in-depth, reader-focused articles about Linux and the free-software community. Please subscribe today to support our work and keep LWN on the air; we are offering a free one-month trial subscription to get you started.

Russ Allbery agreed that the DFSG was not relevant; he also warned that citing the Social Contract and DFSG "turns the conversation into rules lawyering without addressing the actual issue". However, even though xsnow is DFSG-compliant, he did say that the flag display may be something Debian does not want in its archives:

> I would, in general, say that software that behaves in deceptive ways, which includes hidden behavior changes based on usernames, locales, or other local settings or information that no user would reasonably expect to change behavior in this way is probably not something that we want to have in Debian. It's a very slippery slope and also likely to create a lot of drama to very little benefit.

Ivanov said that he understood the point that xsnow did not violate the DFSG. But, he asked, shouldn't its hidden functionality be treated as a bug or behavior that should be patched out "to restore the application's neutral and intended functionality for all users equally?" Bill Allombert suggested that he open a bug report, since the Debian development list was not the correct venue for the complaint.

#### Forecast calls for no xsnow changes

To date, Ivanov has not opened a bug report, and the conversation seems to have run its course. I have emailed Vermin to ask if he was aware of the complaint, and if he would be willing to roll back the Ukrainian flag display if a bug were filed. So far, I have not received a response.

Even though Vermin may not want to change xsnow's behavior, Debian package maintainers have been required to make changes for technical reasons—or have had packages removed from the archive for offensive content. In August 2025, two "offensive" fortune packages were removed ahead of the trixie release following a lengthy discussion. In October 2025, Debian's Technical Committee decided that an upstream systemd change would need to be reverted because the new behavior broke a number of programs that depended on a world-writable /run/lock directory. In each case, there was a fair bit of discussion and deliberation before the maintainers were overridden.

This is not to argue one way or the other whether xsnow's Easter egg should be removed; it is simply worth pointing out that it is not futile to file a bug against a package even if it's likely that the maintainer will disagree. As a project, Debian gives its developers a wide latitude in how they manage their packages, but a packager's decisions can be overridden on the rare occasions when the project deems it necessary. Convincing the project to do so, however, requires the petitioner to put in the work. Merely complaining on the mailing list is unlikely to achieve any results.

- * *

to post comments [](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

I have a very mild protest in a package of mine

Posted Jun 29, 2026 15:26 UTC (Mon) by **dskoll** (subscriber, #1630) [Link] (3 responses)

I also have protestware in Remind, a calendar program I wrote. However, it's only visible if you run strings against the binary, so it's pretty unlikely to be noticed.

The program does come with a bunch of sample calendar files that mark important LGBTQ community days, and while I don't think these are protestware, they could be viewed as such in some countries. The manual page also has an example that commemorates the 1989 Tienamen Square massacre which, in China, is probably considered a very serious offence.

I don't think protestware is a problem unless it seriously interferes with the normal and intended use of the software, at which point it becomes a bug or even malware. And since it's open-source, people who are very offended by the protestware can remove it.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

I have a very mild protest in a package of mine

Posted Jun 29, 2026 15:51 UTC (Mon) by **rbtree** (subscriber, #129790) [Link] (2 responses)

As a Russian speaker who might very well have the ru locale running on his system, I'm personally fine with this "protestware" (at least it does not rm-rf your filesystem like some of them did back in 2022), but it is because I do not live in Russia.

People in Western countries don't realize how bad the situation on the ground actually is¹; random Ukrainian flags showing up on your work monitor can result in severe problems for you (like losing you job, or worse), especially if you work in the government sector. If they show up on your laptop in a random cafe or an airport, you might very well get a beating from one of many "war heroes" that walk around the cities these days.

No, the government sector doesn't just make missiles and bombs, it also covers schools, hospitals, many other things.

[1]: random example: a former Estonian president recently made a complete ass of himself by going to Xitter and publicly claiming that protesting and speaking against the war in Russia does *not* land you in prison for up to 8 years, so why are they silent and are doing nothing? Even the 1000%-pro-Ukraine Russian opposition was shocked.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

I have a very mild protest in a package of mine

Posted Jun 29, 2026 16:44 UTC (Mon) by **dskoll** (subscriber, #1630) [Link]

I agree that any protestware should not show up by default, but should require some action on the part of the user or be buried in the man page. Putting users at risk is never good.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

I have a very mild protest in a package of mine

Posted Jun 29, 2026 16:44 UTC (Mon) by **mss** (subscriber, #138799) [Link]

It looks like the controversial code block just changes the probability of Ukrainian flags appearing for the `ru` locale.

In other words, these flags could appear even for other locales, albeit then with much lower probability.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 15:51 UTC (Mon) by **cen** (subscriber, #170575) [Link] (10 responses)

The way I see it, this is a slippery slope and should be banned by policy. Any change that is done to the upstream package which has no real technical merit but essentially introduces political messaging sounds problematic. You could then have a Russian maintainer inserting some other changes in some other package and open up maintainer wars reflecting real life conflicts (Iran, Palestine, Israel etc etc). If Debian ships such packages in their official repos it implicitly endorses such changes as a project.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 16:03 UTC (Mon) by **farnz** (subscriber, #17727) [Link] (3 responses)

Note that the code in question is also in the upstream package. It's not a Debian-specific modification. [](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 16:40 UTC (Mon) by **jzb** (editor, #7867) [Link] (1 responses)

Sorry if that did not come through clearly enough in the article. Yes, it's in upstream xsnow as well. Not sure exactly which version it landed in, but it's not unique to Debian.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 21:42 UTC (Mon) by **ballombe** (subscriber, #9523) [Link]

The Debian maintainer is the upstream author, AFAICS.

However, as I said, as long as nobody is willing to fill a bug report, the issue is moot.

It seems a bit dishonest to complain to debian-devel without ever bothering to fill a bug report, IMHO.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 16:59 UTC (Mon) by **cen** (subscriber, #170575) [Link]

I wasn't aware this was an upstream change. That changes things and makes my comment irrelavant. Thanks for the clarification.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 17:47 UTC (Mon) by **bluca** (subscriber, #118303) [Link] (2 responses)

You'll have to take away "ip moo" from my cold, dead hands

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 29, 2026 23:18 UTC (Mon) by **ATLief** (subscriber, #166135) [Link]

apt moo

apt moo moo

apt moo moo moo

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problem-apt-ic

Posted Jun 30, 2026 6:03 UTC (Tue) by **k3ninho** (subscriber, #50375) [Link]

Can i haz sponsor for systemd-moosay?

K3n.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic

Posted Jun 30, 2026 14:03 UTC (Tue) by **patrakov** (subscriber, #97174) [Link] (2 responses)

Debian already had a case in the past where they removed a package with early protestware - but in that earlier case, it was a protest by upstream against Debian packaging practices. Upstream deliberately broke the package for every Debian user except the maintainer. I am talking about micq.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

mICQ

Posted Jun 30, 2026 14:06 UTC (Tue) by **corbet** (editor, #1) [Link]

That episode was, of course, covered here at the time.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Problematic - article in question

Posted Jun 30, 2026 14:06 UTC (Tue) by **jzb** (editor, #7867) [Link]

Huh. I had either missed that or have completely forgotten about it... either is entirely possible. Looks like we covered it, though: "The trojaning of mICQ", February 18, 2003. Wish I'd known/remembered it when I was writing the article; that would have been a good thing to include. Thank you much for the comment!

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

The Russian language is more than just politics..

Posted Jun 29, 2026 19:16 UTC (Mon) by **jpeisach** (subscriber, #181966) [Link] (3 responses)

A lot of people in my town came from Russia. Some even speak only Russian. (This is in the US)

So because they don't speak English, they may use the Russian keyboard layout.

And even though they may support the cause, it's kind of.. um.. unfair? That they have to deal with this?

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

The Russian language is more than just politics..

Posted Jun 29, 2026 19:18 UTC (Mon) by **zdzichu** (subscriber, #17118) [Link] (1 responses)

If they have russian citizenship, they are eligible to vote in russian elections. That's why there are abroad voting stations.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

The Russian language is more than just politics..

Posted Jun 30, 2026 17:28 UTC (Tue) by **LtWorf** (subscriber, #124958) [Link]

By definition, if you can elect someone (meaningfully) different, it was not a dictatorship.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

The Russian language is more than just politics..

Posted Jun 30, 2026 16:25 UTC (Tue) by **farnz** (subscriber, #17727) [Link]

It's worth being clear that what they "have to deal with" is being shown Ukrainian flags at a higher rate that those of your neighbours with an English locale, and then only if they choose to run xsnow. It's only a big deal when you're in a region where displaying a Ukrainian flag on your screen makes you a target.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 9:03 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (30 responses)

I believe it's an important topic in general (not just this specific project or even Debian). It appears Debian, and many other Linux distros (probably all) don't even try to regulate the (in)discriminatory behavior of the software they ship. And this is while spelling out in much detail that the *license* must not be discriminatory in any way. BTW, the same strict rules appear in the code of conduct, but limiting the scope to the "developers".

Until today, I was absolutely sure the same applies to the software itself. BTW, any Debian user is either an active or a potential future Debian developer. If one Debian developer knowingly ships a software that intentionally annoys (or even puts at serious legal risk) another developer, isn't it a violation of the code of conduct, even setting aside obvious, IMHO, ethical issues?

I, for one, would stop contributing to a project that tolerates such discriminatory behavior.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 9:16 UTC (Tue) by **mjg59** (subscriber, #23239) [Link] (29 responses)

It's certainly the case that Debian has had disputes over whether software was suitable based on criteria other than technical correctness - we can go back over 20 years to find the hot-babe argument. But also Debian is somewhat inevitably going to be influenced by the attitudes of its developers, and with those being overwhelmingly (but not exclusively) in favour of it being bad to initiate wars of aggression, I think it's likely that there will not be an entirely consistent approach to this class of problem.

(I should emphasise that I do not believe that all Russian citizens or residents are in favour of the Ukrainian invasion - but at the same time I would, as a US citizen, not fundamentally object to Debian packaging software that in some way penalised me due to the Iran bombings)

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 9:31 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (28 responses)

I think there *is* "an entirely consistent approach to this class of problem": a person must not be discriminated against on the basis of their race, sex, nationality, passport color, etc. In this specific case, not on their spoken language.

I might be sympathetic to something like 'if (username == "putin")' or 'user.last_voted_for = "putin"', but given a negligible chance of evaluating as true of the former and unavailability of the relevant API of the latter, it's better to separate political opinions from the software development of public projects.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 11:03 UTC (Tue) by **alx.manpages** (subscriber, #145117) [Link] (24 responses)

I believe the second paragraph contradicts the first one. As a joke it is fine, but in seriousness, we don't want to discriminate people by their name or their political opinions.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 11:24 UTC (Tue) by **evgeny** (subscriber, #774) [Link]

I, of course, fully agree with you. My last comment was to show that I might *understand* (not necessarily agree or encourage) an attempt to punish *specific* person(s) responsible for war crimes - as was the intent (hopefully) of the author of xsnow. But the real consequences are felt not by the Russian fighters in the trenches nor by the politicians in the Kremlin, but by innocent (unless proven otherwise) Debian users in Russia who, by the presence of Ukrainian symbols on their screen, may very realistically be subjected to administrative or criminal laws (or just be physically beaten by "patriotic" passers by).

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 11:53 UTC (Tue) by **pizza** (subscriber, #46) [Link] (19 responses)

> but in seriousness, we don't want to discriminate people by their name or their political opinions.

Not just Nope, but HELL NOPE.

Some folks' "political opinions" hold that others are essentially subhuman, and deserve to be, if not put to death outright, should be made to suffer and excluded from solely because they exist.

In today's hyper-connected world, the distinction between "opinion" and "active advocacy" is pretty much non-existent.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 12:31 UTC (Tue) by **pizza** (subscriber, #46) [Link]

> Some folks' "political opinions" hold that others are essentially subhuman, and deserve to be, if not put to death outright, should be made to suffer and excluded from solely because they exist.

Bah, massive editing fail. Should read:

...and deserve to be, if not put to death outright, made to suffer and excluded from society solely because they exist.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 13:28 UTC (Tue) by **alx.manpages** (subscriber, #145117) [Link] (17 responses)

Let's consider that Debian could somehow distinguish people who voted $EVIL from the rest.

Should Debian packages behave differently for those people?

Do we trust people to be in charge of the decision of which values of $EVIL are bad enough to deserve this, and also to decide how much different the software should behave?

Also, what if someone voted $EVIL because it didn't have an alternative? Maybe they're coerced into voting $EVIL. Would we accept those as colateral damage?

Also, let's say some $GOOD organization attempts to attack $EVIL, and infiltrates in their servers or otherwise impersonates $EVIL. The software that discriminates $EVIL would consider that the infiltrated $GOOD people are evil, and could hinder the attack, ironically, and maybe even put $GOOD at risk.

I don't mean that programmers should not discriminate people by their political opinions. But I think software should not do it blindly.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 14:17 UTC (Tue) by **pizza** (subscriber, #46) [Link] (4 responses)

> Should Debian packages behave differently for those people?

Only if those behavioral differences are due to an action taken on Debian's part.

But as the behavioral differences are *upstream*, this is a very different conversation.

> I don't mean that programmers should not discriminate people by their political opinions. But I think software should not do it blindly.

Software should do what its authors want it to do. Nothing more, nothing less.

However, as 'xsnow' is Free Software, its users have the right alter the software to do what *they* want, ie becoming authors themselves.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 14:35 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (3 responses)

> Software should do what its authors want it to do. Nothing more, nothing less.

I disagree. A malware does what its authors wanted to do. But is it OK for Debian to knowingly distribute it? In fact, I don't mind, provided it's prominently and very clearly described as such (e.g., "when you install this software, it will silently copy your passwords and send them over to a pirate's account"). But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer. In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions. And, similar to the password sniffer, this hidden feature may put the user's well-being and health at risk.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 14:44 UTC (Tue) by **pizza** (subscriber, #46) [Link] (2 responses)

> But the problem with xsnow, and specifically with this "feature" added, is that it is *not* obvious for a casual user. So it does something not expected, and as such, I see no principal difference between this Easter egg and a password sniffer.

That argument equally applies to web browsers.

Come on. Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute) Which, I might add, runs completely counter to Free Software (and Open Source) principles.

> In both cases, the software acts without the user's explicit or implicit consent to perform non-obvious actions

"Non-obvious" is, at best, *incredibly* subjective.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 15:01 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (1 responses)

> Taking any other position than "software should do what its authors want" is effectively dictating what software folks can or can't write (and/or redistribute)

I beg your pardon. First, "write" and "distribute" are very different things. BTW, the Free Software/Open Source licensing terms are largely about the latter. And I fully agree that it's the right of any person to write any kind of software they like.

But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me. I want to believe that Debian makes every effort to fix security holes as quickly as possible. And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 15:10 UTC (Tue) by **pizza** (subscriber, #46) [Link]

> But you seem to miss my point: it is the *hidden* property of this feature that raises the red flag for me.

Most software features are "hidden".

> And I wish to believe that, similarly, Debian makes every possible effort to ensure that I (or any other user) am not adversely affected by the political opinions of an upstream author.

You may wish to believe this, but has it *ever* been the case?

...Except insofar as the importance of "free software" (and the DFSG) is a political opinion, making Debian itself an exclusionary political statement.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 14:41 UTC (Tue) by **bronson** (subscriber, #4806) [Link] (11 responses)

This is reminding me of the "baby-mulching" license arguments of the 1990s. People yelling at each other endlessly about "should you be able to prevent your software from being used in a baby mulching machine", creating towering hypotheticals and and attempting to argue them all the way through. It was a lot of discussion and I don't remember anything useful coming from it.

Here, we're talking about a bit of code that increases the likelihood of a Ukrainian flag being displayed in a joke program ... if this somehow puts someone in physical danger, then I'd suggest that the issue is more with persecuting humans over trivial things, and not so much with this bit of code. This isn't worth the hypotheticals.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 16:22 UTC (Tue) by **rgmoore** (**✭ supporter ✭**, #75) [Link] (7 responses)

There's a critical difference: baby mulching machines were a deliberately absurd hypothetical, but the behavior of xsnow is real. The easter egg was discovered because it showed up on a real world computer. Even if you accept that the danger to people's well being is a result of Russian government persecution, there's still a real question about whether this general kind of behavior ought to be accepted.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 16:56 UTC (Tue) by **farnz** (subscriber, #17727) [Link] (5 responses)

The challenge is deciding where the line is - if, for example, my country passes a law that says that putting the work "gnome" on a screen is offensive, and punishable by death, should Debian then remove GNOME from the repositories?

When a ban on the possession of "hacking tools" was proposed (which later got watered down sensibly to "possession with intent to commit an offence"), should Debian have removed tcpdump, aircrack-ng, nmap and other packages that could reasonably have been deemed "hacking tools"?

Remember that the easter egg is _not_ "display a Ukrainian flag"; it's "display it more frequently". So, if you're saying that Debian should not have software that could endanger someone in the Russian Federation's safety, you're implicitly saying that no Debian software should display the Ukrainian flag, since that's the problem action; should Debian include censoring software to prevent web browsers displaying a "bad" flag (such as the Ukrainian or Taiwanese flags) by default, that you need to configure off if you're OK with those flags being shown?

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 17:25 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (4 responses)

> The challenge is deciding where the line is - if, for example, my country passes a law that says that putting the work "gnome" on a screen is offensive, and punishable by death, should Debian then remove GNOME from the repositories?

I'm not sure your hypothetical example is any better than the aforementioned "baby-mulching" machine. But let's take this for granted. OK, there is such a country, obviously run by a demonic government. And now I create software (which doesn't have this in its description) that randomly displays this forbidden word on the screen. Moreover, out of my hatred of this government, I decided to show this problematic word much more frequently if the user happens to live in that country, thereby increasing the chances that the user ends their days sooner. Now, I want to hear your opinion: do you believe this is ethical?

> So, if you're saying that Debian should not have software that could endanger someone in the Russian Federation

No, I say that Debian should not have software that *specifically*, *intentially*, and *knowingly* could endanger someone in *any* place in the world.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 18:40 UTC (Tue) by **pizza** (subscriber, #46) [Link] (3 responses)

> No, I say that Debian should not have software that *specifically*, *intentially*, and *knowingly* could endanger someone in *any* place in the world.

Under this standard, most of Debian will have to be removed.

(remember, "intentionally" covers things that are _not_ implemented, such as age verification)

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 19:00 UTC (Tue) by **evgeny** (subscriber, #774) [Link] (2 responses)

Really? Does Debian disable age verification specifically in regions that require it?

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 19:50 UTC (Tue) by **pizza** (subscriber, #46) [Link] (1 responses)

> Does Debian disable age verification specifically in regions that require it?

By _not implementing_ age verification in regions that require it (including by distributing software that does not, ie effectively everything in the archive), they are "endangering users" in those jurisdictions.

At this point, that "not implementing" is both *intentional* and *knowing*.

Another example, more concrete -- Debian includes 'torbrowser', use of which is criminal in many jurisdictions. Debian is therefore endangering those users, and by your logic, torbrowser should be yanked from the archive for everyone else.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 20:10 UTC (Tue) by **evgeny** (subscriber, #774) [Link]

Whether to use the Tor browser is at the user's discretion. Debian doesn't install it by default, nor makes it the default browser. And it certainly doesn't do it on purpose, specifically in the places where its use is forbidden. If you don't see the principal difference with the behavior of xsnow, I give up explaining my point. Let's close this thread.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 17:08 UTC (Tue) by **bronson** (subscriber, #4806) [Link]

And the real answer is generally "this sort of behavior should be frowned upon." I think you won't find much disagreement among any group of developers.

Great. Now, how would you use that? Can you extrapolate from it to determine what to do about this particular xsnow feature? I can't.

The behavior of xsnow is real, yes... and inconsequential. Using it to strong-arm rules into place and force other people to do things doesn't seem like a reasonable response.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 17:34 UTC (Tue) by **LtWorf** (subscriber, #124958) [Link] (2 responses)

What if your software is used by a USA army contractor or the army itself?

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 18:57 UTC (Tue) by **evgeny** (subscriber, #774) [Link]

> What if your software is used by a USA army contractor or the army itself?

Personally, I'm fine with it. If you don't like *your* software to be used in this context, you're free to use a respective licensing clause. But it won't be compatible with DFSG, I believe.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 20:20 UTC (Tue) by **evgeny** (subscriber, #774) [Link]

BTW, thanks for filing the bug report :).

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

No discrimination by political opinion is not practically possible.

Posted Jun 30, 2026 12:45 UTC (Tue) by **farnz** (subscriber, #17727) [Link] (2 responses)

You now have a hard problem to solve; some Russian speaking Ukrainians want their system to display the Ukrainian flag to represent the ru_UA locale, and a refusal to include the Ukrainian flag is discriminating against their political opinions, because (while being Russian-speaking), they believe that Ukraine is separate from Russia.

As evgeny's post makes clear a Russian resident may well have good reason to want their system to never display the Ukrainian flag, because there are Russians who, as a matter of political opinion, consider its very existence a problem, and expect you to show the Russian Federation flag instead (since they consider Ukraine to be a Russian Federation province, currently in active rebellion).

At this point, you have a problem to resolve: how do you ensure that a Russian looking for the "right" Russian locale for their needs does not see the Ukrainian flag, while also ensuring that the Ukrainian looking for the "right" Russian locale for their needs does see it?

More generally, this is Popper's paradox of tolerance; there are limits to what you can include if you're trying to be inclusive, and that area of philosophy gets quite complex.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

No discrimination by political opinion is not practically possible.

Posted Jun 30, 2026 14:23 UTC (Tue) by **amacater** (subscriber, #790) [Link] (1 responses)

And flag wars create their own problems. Debian at one point lost a very capable developer over arguments over appropriate nomenclature/locales/flags for Chinese locales (and the nature/extent of proper sovereignty and naming/political considerations) concerning Taiwan. It's one reason why Debian doesn't normally link locales with flags.

xsnow is strictly an optional package - anyone who doesn't need it can remove it without compromising the other functionality of their system.

Unfortunately too, protest ware is hard to limit: I remember reading of something that was not to be used by S. African police. This with the intention of creating problems for them under the apartheid regime.

Unfortunately, the ban continued into post-apartheid S. Africa where the software was still useful.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

No discrimination by political opinion is not practically possible.

Posted Jun 30, 2026 15:27 UTC (Tue) by **farnz** (subscriber, #17727) [Link]

The added problem here is that whether or not xsnow counts as "protestware" depends on your point of view. The thing that makes it "protestware" is that it displays a certain symbol, and if you're in a specific subset of locales, it displays that symbol much more frequently than if you're not.

It doesn't ban you from using or modifying it (you could, quite legally, replace extratree.xpm with something else, for example), unlike your example of a program not to be used by South African police. As a result, it's not really "protestware" in the same sense as your second example, because a Russian could easily have a package to replace extratree.xpm with (say) a drawing of a larch (or other tree). Further, once we have world peace, and flags stop upsetting people, the xsnow "protest" becomes a non-issue; it's only an issue because of current political views in the Russian Federation.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 19:51 UTC (Tue) by **kleptog** (subscriber, #1183) [Link] (2 responses)

I think you have to think carefully about the use of the word "discrimination" here. It of course meets the literal definition "change based on attribute" but legally the requirement is actual harm, or some negative impact. Here it's indirect: you see some extra flags which might in some areas be problematic but seeing a flag doesn't hurt anyone. That someone else might hurt you isn't really relevant.

Next people will be complaining that seeing a rainbow flag harms them.

And here we're talking about a package that according to popcon has 305 installs, so really nothing to get worked up about.

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 20:03 UTC (Tue) by **evgeny** (subscriber, #774) [Link]

> And here we're talking about a package that according to popcon has 305 installs

No, in the top post of this thread (https://lwn.net/Articles/1080234/), I said: "I believe it's an important topic in general (not just this specific project or even Debian)."

[](https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9/)

Bug of feature?

Posted Jun 30, 2026 20:14 UTC (Tue) by **nhippi** (subscriber, #34640) [Link]

> And here we're talking about a package that according to popcon has 305 installs, so really nothing to get worked up about.

Classic streissand effect..

Comments and public postings are copyrighted by their creators.

Linux is a registered trademark of Linus Torvalds