[JdeBP]

The naïveté of that position is that the users are not informed ahead of time that there's a random chance of a political protest popping up on their screen, so do not get to make an informed choice before it is perhaps too late. It's not mentioned in the doco. It's obfuscated in the source code as an 'extra tree' in an array of xpmtrees. The commit that added this had the commit message 'willem'.

[michaelmrose]

So 3% of the pop uses Linux. I shouldn't be surprised that 3% of those use Debian. I WOULD be surprised to find that more than 1 in 10k has EVER used xsnow 1 in 1M running it continually. Note this is actually wildly overstated. I have not even touched on the settings which would show flags.

Then we have to imagine they run xsnow all the time and somehow don't notice the dangerous political stuff OR run it for the first time.

If we start with 140M Russians this has certainly never happened and will almost certainly NEVER happen.

It is actually far more likely that someone should actually get caught using it trying to see the flags and have to explain that to their boss.

[LtWorf]

How many victims should something generate before considering removing it from Debian?

Funny thing how here we are talking about keeping it despite it can apparently cause people to die, while Debian was so quick to decide that the offensive fortunes that nobody had complained about for the past 23 years were incredibly harmful and had to be removed right away :D

[port11]

What is the acceptable number of, say, tortured people, before this becomes an issue for you? What if your math is a little off and exactly one person dies? Are you okay with that?

We have to draw the line somewhere.

[dgellow]

Please, tell me, who is ever using xsnow in a place where that would be problematic? It’s such a niche software. Again, complete non-issue.

[LtWorf]

> who is ever using xsnow

We don't know? Debian doesn't spy on users.

[throw_a_grenade]

popcon shows 302 users as of now: https://qa.debian.org/popcon.php?package=xsnow

[LtWorf]

302 installs, could be one person with 302 virtual machines, and could be 1 million with popcon disabled (which is the default).

[dgellow]

It could also be 302. You cannot just invent a massive user base because you have no information. Given how niche the software is there is no reasons to believe it is widely used in places where that would cause issues. I suspect not a single person has been impacted by seeing Ukrainian flags.

The push back in this is obviously coming from an anti Ukraine sentiment

[LtWorf]

I do agree that the user base is possibly minuscule. But as I said in other comments, even if it only happened to one single person, I wouldn't consider it an acceptable risk.

We've removed stuff from debian for way less than this.

> The push back in this is obviously coming from an anti Ukraine sentiment

You can read minds?