Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

211–220 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#211

Post by charcircuit »

mattmanser wrote: post #61
sam_lowry_ wrote: post #36

Earlier quoted context omitted.

Why? Should it use the dict protocol, then?

Because without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.

>People in your coffee shop on the same WiFi could read it.

WEP has been deprecated for over 2 decades.

Re: StarDict sends X11 clipboard to remote servers

#212

Post by jeltz »

charcircuit wrote: post #204
npteljes wrote: post #109

Earlier quoted context omitted.

Android has its fair share of issues as well. For a recent issue, take a look at the localhost tracking, wherein "Meta devised an ingenious system that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session": https://news.ycombinator.com/item?id=44235467

It's by design that apps on Android can talk to each other. It doesn't require a sandbox escape to do. Usually it's done via binder, but it also works through shared memory, unix sockets, network sockets, or pipes.

And it is by design that anyone can read the X11 cilpboard so I sm not sure I get your point.

Re: StarDict sends X11 clipboard to remote servers

#213

Post by ziml77 »

M95D wrote: post #179

In my Windows, it wouldn't be a problem. The firewall I use would pop up for any new program that tries to connect somewhere. But Linux doesn't have a per-program firewall. ... and even if it did, there's no way to do popups/questions from the kernel, ... and even if there was, most programs would just run curl or wget or openssl. That would mean a popup for each and every connection attempt through those programs.

Windows does certain security things better than Linux OSes, which makes it such a shame that Microsoft keeps shipping more and more stuff with Windows that undermines all that work.

Re: StarDict sends X11 clipboard to remote servers

#214

Post by thegrimmest »

jacquesm wrote: post #31
sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

Such responses to me are proof of malicious intent.

Why can't reasonable people disagree here? Surely if the utility of some features might outweigh the security concerns for some people. Making features opt-in instead of opt-out significantly changes their discoverability and usage metrics. On the whole, a translation system that has a feature to translate selected text seems hardly surprising. Similarly, using an online service to improve translation quality and reduce local resource usage also seems reasonable.

Fundamentally, always-online, home-phoning features are the norm, and it should be up to OS distributions to manage security postures such as allowlists for network access. Think something along the lines of "StarDict wants to connect to dict.cn. Allow/Deny?".

Re: StarDict sends X11 clipboard to remote servers

#215

Post by npteljes »

charcircuit wrote: post #204
npteljes wrote: post #109

Earlier quoted context omitted.

Android has its fair share of issues as well. For a recent issue, take a look at the localhost tracking, wherein "Meta devised an ingenious system that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session": https://news.ycombinator.com/item?id=44235467

It's by design that apps on Android can talk to each other. It doesn't require a sandbox escape to do. Usually it's done via binder, but it also works through shared memory, unix sockets, network sockets, or pipes.

I get that. Well, not in the linked Facebook case, seeing how much legal attention they have attracted, but in general. And I think that the X server's design is the same. What StarDict did was using an intentional part of the design, not a hack, or exploiting vulnerability. Which is why the Android comparison doesn't stand.

Re: StarDict sends X11 clipboard to remote servers

#216

Post by saghm »

voidUpdate wrote: post #174
wolfi1 wrote: post #147

Earlier quoted context omitted.

[flagged]

There are probably a non-zero amount of people who are older than 20 who have not read the hitchhikers guide, or don't recall some parts of it. For example, me

Plus, there's no reason to assume no one here is under 20. We should be _encouraging_ young people who are interested in tech and privacy, not discouraging people from posting explanations about tangential pop culture references because we think they aren't relevant for people who are older.

Re: StarDict sends X11 clipboard to remote servers

#219

Post by charcircuit »

jeltz wrote: post #212
charcircuit wrote: post #204

Earlier quoted context omitted.

It's by design that apps on Android can talk to each other. It doesn't require a sandbox escape to do. Usually it's done via binder, but it also works through shared memory, unix sockets, network sockets, or pipes.

And it is by design that anyone can read the X11 cilpboard so I sm not sure I get your point.

My point is it's the browser app's responsibility to add extra security before reaching out to private / loopback addresses when it wants extra privacy.

Android already provides a way to sandbox apps from one another, so if people don't want social media apps talking with other apps they can already separate them.

Re: StarDict sends X11 clipboard to remote servers

#220

Post by ants_everywhere »

charcircuit wrote: post #211
mattmanser wrote: post #61

Earlier quoted context omitted.

Because without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.

>People in your coffee shop on the same WiFi could read it. WEP has been deprecated for over 2 decades.

you may be surprised at the number of unsecured WiFi networks there are.

I see them in 2025 in captive portals, public libraries, and when traveling abroad.

Post reply on HN