Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

171–180 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#171

Post by heresie-dabord »

eadmund wrote: post #142

The Wayland framing at the end strikes me as misleading. This gets it exactly right: > Or maybe StarDict would have started asking for special permissions to let it work on Wayland, and users would have accepted those defaults the same way they currently do. Yes, that’s what it would do. Its installer might even configure that special permission automatically, without user intervention. Malware’s gonna mal. Wayland m…

It is not misleading, Wayland is better than Xorg in this particular respect.

But the other concern is part of the systemic problem. Consider that the data that was transmitted was sent in the clear!

> StarDict ... while running on X11, using Debian's default configuration, it will send a user's text selections over unencrypted HTTP to two remote servers.

> Any user who did read the description of the package, and who knew what the YouDao plugin would do, might nevertheless expect the resulting communication to at least be encrypted. But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. So, not only are these servers sent any text the user selects, but anyone who can view traffic anywhere along its path can see the same thing.

Re: StarDict sends X11 clipboard to remote servers

#172

Post by guappa »

account42 wrote: post #84
guappa wrote: post #64

Earlier quoted context omitted.

You basically need to call a vote or ask the tech committee to rule otherwise if the maintainer says it's fine. It's not really a bug if it's an advertised feature you don't like, so security team cannot do much in theory.

That's a bad policy then.

Write a new one and post it on debian-vote and see if it gets approved :)

Re: StarDict sends X11 clipboard to remote servers

#173

Post by zahlman »

chainingsolid wrote: post #155
sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

I install stuff from Debian's repos for 2 reasons. Convience & trust. And while people do complain when maintainers modify packages behavior, I think people would rather have the send my clipboard contents to someone else to be opt-in. Instead of violating their trust!

If this level of modification is required for a package to fit in with the distro's philosophy, maybe better not to include it at all.

Re: StarDict sends X11 clipboard to remote servers

#174

Post by voidUpdate »

wolfi1 wrote: post #147
tomsmeding wrote: post #136

Earlier quoted context omitted.

For the uninformed: this is a quote from The Hitchhiker's Guide to the Galaxy.

[flagged]

There are probably a non-zero amount of people who are older than 20 who have not read the hitchhikers guide, or don't recall some parts of it. For example, me

Re: StarDict sends X11 clipboard to remote servers

#175

Post by guappa »

DonHopkins wrote: post #140
Lockal wrote: post #130

Earlier quoted context omitted.

There are dozens of chrome extensions that translate (read: submit to untrusted server) on hover / highlight / context menu / textarea edit / etc. It is implied, that user acknowledges this functionality and accepts the risk. This includes untrusted server (because that's how they proxy requests to Google/Bing/Yandex Translate without exposing API keys). Security illiteracy? Yes. Malicious intent? Probably no. Does b…

[flagged]

The fix is to remove the package…

Re: StarDict sends X11 clipboard to remote servers

#176

Post by guappa »

poemxo wrote: post #101
npteljes wrote: post #95

Earlier quoted context omitted.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.

Can the problem be fixed without making the software useless?

Re: StarDict sends X11 clipboard to remote servers

#177

Post by zahlman »

IshKebab wrote: post #32
rfoo wrote: post #26

Earlier quoted context omitted.

For me it's my most used super long command line flag. For a brief moment `--break-system-packages` surpassed it, then I discovered `pip` accepts abbrev flags so `--br` is enough, and sounds like bruh.

> --break-system-packages You can avoid that clusterfuck using `uv tool install`. E.g. `uv tool install pre-commit`.

It's also not hard to just manage a damn virtual environment yourself.

Re: StarDict sends X11 clipboard to remote servers

#178

Post by angled »

DonHopkins wrote: post #133

[flagged]

A great comment, but your brief mention of fetchmail brought back a flood of memories of .fetchmailrc’s and watching dots on screen as I downloaded my mail from POP3 servers over all sorts of horrible baud rate modems, before I sensibly switched to sending and retrieving my email via UUCP.

Re: StarDict sends X11 clipboard to remote servers

#179

Post by M95D »

In my Windows, it wouldn't be a problem. The firewall I use would pop up for any new program that tries to connect somewhere.

But Linux doesn't have a per-program firewall.

... and even if it did, there's no way to do popups/questions from the kernel,

... and even if there was, most programs would just run curl or wget or openssl. That would mean a popup for each and every connection attempt through those programs.

Post reply on HN