This post caught my eyes immediately because I have been sort of benefiting from StarDict project. Although I do not use it directly. I have been using sdcv, a CLI tool that reads StarDict dictionary. It’s minimal and serves me well.
StarDict sends X11 clipboard to remote servers
111–120 of 350 posts
Re: StarDict sends X11 clipboard to remote servers
#112> Part of the justification for moving to Wayland over X11 is to make security vulnerabilities relating to one application spying on another more difficult to introduce. Yea, because, how else am I going to run shady poorly maintained dictionary software that ignores system settings from a hostile country? What kind of world are we living in with X11?! The software could just as well hook into your downloads folder a…
I agree with you, this is not an X11 issue, it's a "why are we letting software like this in the repository" issue. The kind of lax attitude towards security I'd expect from a random AUR package, not in the Debian repo.
Re: StarDict sends X11 clipboard to remote servers
#113Earlier quoted context omitted.
Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-know…
> a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled.
I personally don't use that one, for me the red underline is enough.
Re: StarDict sends X11 clipboard to remote servers
#114Earlier quoted context omitted.
> But for many ESL or non-English users out there, the "translation" is a must. As an ESL user, I vehemently disagree. You're only going to need translations as long as you keep relying on translations. Like it or not but English is the lingua franca of the computing age and you're doing yourself a disservice if you don't learn it.
> English is the lingua franca Yes, so to learn English, ppl need some kind of "translator" tool, no? The most comprehensive one (but very old) out there is stardict.
No, you don't need a translator tool to learn other language. Certainly not one that automatically translates everything you copy.
Once you know the basics (which a translator won't teach you) the most effective way to become proficient is practice, which is the opposite of relying on a tool to translate things for you.
Re: StarDict sends X11 clipboard to remote servers
#115Earlier quoted context omitted.
Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet . The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".
Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?
Is this supposed to be some kind of gotcha argument? Against what?
Re: StarDict sends X11 clipboard to remote servers
#116Earlier quoted context omitted.
Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-know…
There’s also a way simpler way: send a hash prefix to server, get a list of matches. Google Safe Browsing does this with URLs, for example.
Re: StarDict sends X11 clipboard to remote servers
#117> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…
Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
There are two scenarios I believe, first accidentally sending a (decent) password, and second the server not learning what you actually look up.
For the first case, sending a hash would prevent the server from learning a password that is not in the dictionary, something like password5 would hash to gibberish.
For the second, the server needs to know what to actually send back. I believe Google's malicious website check works (or used to) by truncating a hash an then just sending the answer for some 128 or so websites and have the browser figure out which of them the user wanted to visit. That creates some deniability over witch website you actually visited and should be also usable to prevent the server from learnering what you actually looked up.
So yes, I think you could design a more secure Protokoll. Though general security disclaimer the people trying to read your letters probably spend more time attacking than I spend writing this post.
Re: StarDict sends X11 clipboard to remote servers
#118There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues Luckily there are things like opensnitch that can block some of these issues: https://github.com/evilsocket/opensnitch
That is interesting.
There is nothing in that list anything like as bad as this. The next worst is Chromium which is no surprise.
Re: StarDict sends X11 clipboard to remote servers
#119Earlier quoted context omitted.
Besides, capturing text from other applications is very much required for various utilities. It's as much of a security feature in Wayland as turning off your computer and never turning it back on is.
There is a separate, privileged, interface that this kind of utility can use. Meanwhile, the other 99% of applications don't need unlimited permissions.
But then StarDict would still be sending your selections out.
Personally I think the X11/Wayland distinction is moot, given this appears to be an explicit feature of StarDict, and it seems more likely it just hasn't been ported to Wayland yet.
Re: StarDict sends X11 clipboard to remote servers
#120> Part of the justification for moving to Wayland over X11 is to make security vulnerabilities relating to one application spying on another more difficult to introduce. Yea, because, how else am I going to run shady poorly maintained dictionary software that ignores system settings from a hostile country? What kind of world are we living in with X11?! The software could just as well hook into your downloads folder a…
I agree with you, this is not an X11 issue, it's a "why are we letting software like this in the repository" issue. The kind of lax attitude towards security I'd expect from a random AUR package, not in the Debian repo.
It's been in Debian for more than 20 years (see changelog here: https://tracker.debian.org/media/packages/s/stardict/changel...). It's not clear to me if said "autosend off clipboard contents" has been in there the whole time though.