Long-term Debian user here. Deviating from the featureset offered by the upstream package that had been stable since forever is an unexpected move. Patches usually fix bugs or improve system integration. It is not normal that running apt upgrade breaks a setup.

I don't personally use (or knew of) any of the network features in keepassxc, but this is the kind of change that you announce in one release, explaining how people that use it can keep using it, and then apply in the next release. Or, indeed, just make a second package for those who want the hardened setup.

There is an argument for the hardened version being the default, but moving from featureful to hardened is a significant change and warrants more than just pushing it and waiting for people to trip over it

Agreed. It's ok to find the extras useful, but it's not automatically right to include them let alone arm them by default.

It may not be automatically wrong either because there are a few imo weak arguments that some of the extensions outweigh their own increased attack surface by increasing usage of better passwords genetally and decreasing usage of the copy-paste buffer, so I won't go as far as to say that.

But what is wrong is acting like the opposite is also automatically wrong.

KeePassXC tooted something like "warning: debian removed all functions" obviously ridiculous unless they removed the function of encrypting and storing passwords. I replied "warning: KeePassXC has confused KeePass users with Lastpass users"

If you want convenience over all else, then why are you even using keepass? Google and MS will happily store all your passwords for free and in the cloud and automatically fill them into forms. So convenient! Let alone onepass/lastpass etc.

Security is not incidental to this particular apps purpose, it's the central and indeed only purpose.

"This is why no one should use debian"? What a ridiculous statement.

Do you understand why Klode's behaviour is probably pushing people away from using & contributing to Debian?