Hi, Four days after this bug report was closed, on https://tracker.debian.org/pkg/ntdb , I see no indication that the NTDB packages were removed from unstable. This was the main point of this bug report: evicting an unmaintained code base with known (if CVE-less, AFAIK) security issues from the Debian archive, in time for Buster, as hinted by upstream :)
That won't automatically remove the NTDB packages from the computers which already have them installed (nearly one in six computers which report to popcon lists libntdb1, for what popcon is worth), but at least, removing the NTDB packages from Buster onwards will help prevent programmers from using them, unknowing that they shouldn't do it. In the longer term, even TDB will disappear, as Samba is switching away from TDB to LMDB for performance reasons, though it was a clear security regression last time I looked. The few other projects which use TDB will eventually follow suit, or be replaced (e.g. pulseaudio, I'm told). Best regards, Lionel Debroux.
