Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

151–160 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#151

Post by komali2 »

exe34 wrote: post #89
CorrectHorseBat wrote: post #22

Earlier quoted context omitted.

[flagged]

That's like saying Afgans have a different idea of consent.

Not really because "Chinese" is being used here as an indicator of nationality, not ethnicity.

I disagree with using it that way because it feeds into the CPC's propaganda mission to conflate the ethnicity of "Han" with citizenship of the PRC, which aids their cultural imperialism ('Taiwan is "Chinese" and we are "China" so therefore people in Taiwan are our people!'). Also the definition is being stretched to include anyone with even the vaguest ethnic ancestry from within territory ruled by the PRC or historic empires ("China" is a word that basically means "empire")

Anyway I agree that people from the PRC are more used to throwing up their hands at invasions of privacy since the government having total insight into your life is a given there, and to many a positive thing (they may believe it keeps them safe). I also believe that growing up as one of one billion people gives one a sense of useless anonymity - who cares if someone sees your clipboard, there's just too many people for it to matter.

Re: StarDict sends X11 clipboard to remote servers

#152

Post by [deleted] »

sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

[deleted]

Re: StarDict sends X11 clipboard to remote servers

#153

Post by Sesse__ »

markasoftware wrote: post #17
yjftsjthsd-h wrote: post #13

Earlier quoted context omitted.

Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?

a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-know…

> a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private.

The typical use of a Bloom filter is to have it locally as a prefilter, not to send hashes to the server.

Re: StarDict sends X11 clipboard to remote servers

#154

Post by npteljes »

DonHopkins wrote: post #143
npteljes wrote: post #92

Earlier quoted context omitted.

I think so too. It's cultural difference, and ignorance at most. I doubt the maintainer has control over that two random dictionary websites, or was tasked by them to do this or anything like that. They are just a different person, and they didn't give a fuck.

[flagged]

Yes, I do feel strongly about attributing malice to someone who I think didn't warrant it. Especially do I think that they are not malicious, because of the fact that they don't admit to their doing as a security hole, but as functionality. And I do care about security a lot - if this was on my software repository, I'd frankly pull the package until it's fixed.

>why it's not malicious to write and distribute a program that sends passwords and other sensitive information over unencrypted http in 2025

One of the reasons is that it has been like that since at least 2009, so for 16 years.

I'm not defending the bug. It's a glaringly stupid thing to do, and distribute, and it questions the competency of everyone involved. I do maintain that it's not malicious intent.

Re: StarDict sends X11 clipboard to remote servers

#155

Post by chainingsolid »

sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

I install stuff from Debian's repos for 2 reasons. Convience & trust. And while people do complain when maintainers modify packages behavior, I think people would rather have the send my clipboard contents to someone else to be opt-in. Instead of violating their trust!

Re: StarDict sends X11 clipboard to remote servers

#156

Post by nullify88 »

paffdragon wrote: post #134

Somewhat related, I was quite surprised when I discovered that my Samsung phone was sharing ALL my clipboard with all my other Samsung devices, including passwords copied into the clipboard, and even preserving the history. I can't remember if the sharing was enabled by default or I opted in by accident. I assume it also goes through their servers to reach my other devices. I could disable the sharing, but still can'…

I usually suggest not to create or login with a Samsung Account on Samsung devices. It's just another opportunity for a company to get at your data.

Re: StarDict sends X11 clipboard to remote servers

#157

Post by frumiousirc »

londons_explore wrote: post #145

> According to Debian's package popularity contest statistics, only 178 people have StarDict installed A problem for those 178 people... But on a global scale this isn't really a concern.

Not everyone participates in the popularity context. By some estimates about 1% of users do: There are about a quarter million popcon responses in Debian's recent popcon graphs. Absolute number of users is hard to estimate but I find one estimate of 20-50 million Debian users. So taking 1% as a lower bound, at least 18k people use StarDict in Debian. I don't know how to guess the number that use StarDict in another OS.

Re: StarDict sends X11 clipboard to remote servers

#159

Post by jeltz »

Inityx wrote: post #76

> But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. What year is it?

I assume it must be 2015 at most because my first job in 2008 ran everything, including images, on HTTPS. But I can imagine some last holdpouts 7 years after that.

Re: StarDict sends X11 clipboard to remote servers

#160

Post by lyu07282 »

jacquesm wrote: post #148
jona-f wrote: post #93

Earlier quoted context omitted.

[flagged]

He could have claimed lack of awareness until it was brought up . After that that excuse no longer holds.

No they could still be just incompetent/negligent rather than malicious. You also forget that they aren't running the translation services, they don't get any data, that's a separate third party you'd have to believe are in on it too. The more important question is if debian is gonna gkick them for it (they should).
Post reply on HN