Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

121–130 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#121

Earlier quoted context omitted.

Besides, capturing text from other applications is very much required for various utilities. It's as much of a security feature in Wayland as turning off your computer and never turning it back on is.

There is a separate, privileged, interface that this kind of utility can use. Meanwhile, the other 99% of applications don't need unlimited permissions.

Those privileged interfaces cover known use cases but don't allow for novel tools - or even full functionality of existing tools in many cases.

You also underestimate how many programs make use of functionality that could be abused in some way. And unless you lock all those interfaces down it's all security theater. Who cares if the display protocol disallows copy paste snooping when there are a million different ways to get the the memory of other processes or the files that they store sensitive information in. And such a locked down ecosystem is antithetical to free and open computing.

I don't use my computer to be secure, I use it to get shit done and and to have fun. I'm not going to accept approaches to security that interfere with that any more than I will accept the same in real life. There aren't any bars over my windows because we have functioning police to deter criminals. I don't need lab tests done for all the food I buy because we have regulations that ensure food sold is generally safe to eat. I go outside without body armor and weapons even though someone could theoretically kill me. 100% security is always a tradeoff for quality of life.

Re: StarDict sends X11 clipboard to remote servers

#122

Earlier quoted context omitted.

I agree with you, this is not an X11 issue, it's a "why are we letting software like this in the repository" issue. The kind of lax attitude towards security I'd expect from a random AUR package, not in the Debian repo.

It's been in Debian for more than 20 years (see changelog here: https://tracker.debian.org/media/packages/s/stardict/changel... ). It's not clear to me if said "autosend off clipboard contents" has been in there the whole time though.

Data leaking bug reported as early as 2009: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 , so it's not looking rosy.

Re: StarDict sends X11 clipboard to remote servers

#123
post #108

Earlier quoted context omitted.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

> pressured Maybe incentivized? $1000? $10000? Would be interesting to hear from the developer himself.

>nor do I think that they gain any advantage of it

Re: StarDict sends X11 clipboard to remote servers

#124

How would you like to be the guy that reported this 10 years ago and had the bug closed on some technicality: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 Given enough eyeballs, all bugs are closed as WONTFIX.

It's not a technicality, the package was removed from Debian so there was no reason to keep the bug report open. And it was reopened by a debian developer when the package was reintroduced a year later. That's not an excuse for why it wasn't dealt with until now but what you are suggesting didn't happen.

[deleted]

Re: StarDict sends X11 clipboard to remote servers

#125

Earlier quoted context omitted.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.

I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731) - are they also malicious? I just think that not enough fucks were given.

Re: StarDict sends X11 clipboard to remote servers

#126
post #101

Earlier quoted context omitted.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.

I think that in today's polarized world, it's very much needed. I think we need to look at each other's fallibilities and failures, and not hate each other for it. But the issue needs to be taken care of, especially since it's known since 2009. It's ridiculous that everyone let if fly for so long.

Re: StarDict sends X11 clipboard to remote servers

#127
post #50

> StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default. StarDict on Wayland has a different issue, it causes a segfault. Sat, 02 Aug 2025: Bug#1003710: stardict crash in gnome with message Segmentation fault https://www.mail-archive.com/debian-bugs-dist@lists.debian.o...

Yeah, I don't really know much about Wayland but.... That does not sound correct to me... Wayland has a copy/paste protocol, and my 5-minute web search indicates that it works much like the X11 copy paste protocol, each application takes care of what will be sent when pasted. then some other application requests a paste, the display server connects the two they negotiate a format and the "copied" data squirts across. that is to say Wayland applications can totally capture text from other applications.

Now if the article meant to say Wayland applications are unable to capture arbitrary text via mechanisms other than then the copy paste protocol I would say fair enough, but it sounds like the problem application is using the normal X11 copy paste protocol. so I don't see how that statement is relevant.

Re: StarDict sends X11 clipboard to remote servers

#128

Earlier quoted context omitted.

You are cherry picking. The next statement says that the scan feature doesn't even work on wayland. Lol. That's worse than working + buggy. (security bugs are just bugs. Nothing special about them) > That does mean that it breaks StarDict's scan feature, though.

No, Wayland is clearly better here. Not allowing an app to do a potentially stupid privacy compromising thing is better that allowing it by default and providing no way to block it. Better does not necessarily mean good though, that Mac approach of block by default but allow users to enable these things for specific apps on settings would be a great improvement.

I'm not sure how Wayland specifically prevents the privacy issue on its own (it can't block network calls), it seems it's down to not implementing the required Wayland calls, but I would be surprised if there was no portal or DBus or similar IPC to get the clipboard on Wayland (which is called out in the package description as noted by the maintainer). The issue is what the app plugin does with the clipboard data, while it's not something I want, I can see people wanting automatic lookups of words.

I think in a similar way to how xz attack required integration via systemd to exist, this is really more about defaults and integrations (which the last message from the maintainer acknowledges and seems to be fixing). https://xkcd.com/2044/ is as always an ever-present problem.

Re: StarDict sends X11 clipboard to remote servers

#129

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

Willful negligence is, at some point, malicious.

Re: StarDict sends X11 clipboard to remote servers

#130

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

Such responses to me are proof of malicious intent.

There are dozens of chrome extensions that translate (read: submit to untrusted server) on hover / highlight / context menu / textarea edit / etc. It is implied, that user acknowledges this functionality and accepts the risk. This includes untrusted server (because that's how they proxy requests to Google/Bing/Yandex Translate without exposing API keys).

Security illiteracy? Yes. Malicious intent? Probably no.

Does being security illiterate equal malicious? Debatable.

Post reply on HN