Package: syncthing Version: 1.29.5~ds1-4 Severity: normal Tags: patch, security
Hi, syncthing is enabled for users on install which is convenient, however it also does so for root and system users (like the ones running the display manager) which is a security risk. I tried to convince upstream https://github.com/syncthing/syncthing/pull/10792 to disable it by default but they don't agree but hopefully we can at least do better in Debian? Cheers and thanks for maintaining syncthing in Debian, -- Guido -- System Information: Debian Release: forky/sid APT prefers testing APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386, arm64 Kernel: Linux 7.0.12+deb14.1-amd64 (SMP w/22 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages syncthing depends on: ii libc6 2.42-17 Versions of packages syncthing recommends: ii xdg-utils 1.2.1-2 syncthing suggests no packages. -- no debconf information
