If I'm not mistaken it simply notifies about new versions and doesn't attempt to update its own code. This is certainly useless in the Debian context but I fail to see how this issue could be a severe policy violation that should lead to the removal of this package if not fixed. Emmanuel Bourg