Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

221–230 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#221

Post by jeltz »

est wrote: post #107
account42 wrote: post #74

Earlier quoted context omitted.

> But for many ESL or non-English users out there, the "translation" is a must. As an ESL user, I vehemently disagree. You're only going to need translations as long as you keep relying on translations. Like it or not but English is the lingua franca of the computing age and you're doing yourself a disservice if you don't learn it.

> English is the lingua franca Yes, so to learn English, ppl need some kind of "translator" tool, no? The most comprehensive one (but very old) out there is stardict.

I cannot comment on how useful these tools are or not since I started using computers in English (there were no translations to my language back then) without any such tool or without knowing any English. I had the of speaking another Germanic language but I would say if you know some basic you can use computers without any tool assistance and learn English quickly.

Re: StarDict sends X11 clipboard to remote servers

#222

Post by torstenvl »

DonHopkins wrote: post #141
npteljes wrote: post #126

Earlier quoted context omitted.

I think that in today's polarized world, it's very much needed. I think we need to look at each other's fallibilities and failures, and not hate each other for it. But the issue needs to be taken care of, especially since it's known since 2009. It's ridiculous that everyone let if fly for so long.

[flagged]

The DC police are inherently federal.

The federal government "exercise[s] exclusive Legislation in all Cases whatsoever, over such District (not exceeding ten Miles square) as may, by Cession of particular States, and the Acceptance of Congress, become the Seat of the Government of the United States."

Re: StarDict sends X11 clipboard to remote servers

#223

Post by ploxiln »

npteljes wrote: post #125
blackhaz wrote: post #96

Earlier quoted context omitted.

But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.

I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 ) - are they also malicious? I just think that not enough fucks were given.

Debian maintainers in 2009 did not let it slide, they did fix it in 2009 ... but it came back, twice! (and it seems not many cared about StarDict in 2015 to fix it promptly that time)

> the same kind of problem was reported by Pavel Machek in 2009 and again by "niekt0" in 2015. The 2009 bug was solved by patching the application's default configuration to disable networked dictionaries. That appears to have worked for a time, but the YouDao plugin, which was added in 2016, does not respect the configuration option. The 2015 problem was not fixed until August 6 of this year (although the package was removed from Debian for unrelated reasons for a few months from 2020 to 2021). That fix just removed the stardict_dictdotcn.so plugin, which also sent translation requests to dict.cn and was later subsumed by the YouDao plugin, from the package.

Re: StarDict sends X11 clipboard to remote servers

#225

Post by ioasuncvinvaer »

bayindirh wrote: post #79
account42 wrote: post #70

Earlier quoted context omitted.

I agree that recommends makes sense but this is a bullshit argument: > On the other hand, apt and aptitude provides previews before doing something. You don't have to accept them. In aptitude's case, you can fine tune before the final commit, even. You can't expect the average user to understand the entire dependency tree and read the description of dozens of random packages that the average program pulls in. RTFM is…

I don't expect average user to read an entire dependency tree. However, apt and aptitude does a relatively good job of explaining their actions' reasons. Let me rephrase: 1. Installation of recommended packages is a good default for the average user, because it provides functionality they expect. 2. If the user is not happy with what's happening, changing defaults are not hard. IOW, if you don't like how your system…

Why does "caring what a package does" mean that someone is no longer a beginner?

All the people I know care what their software does.

Re: StarDict sends X11 clipboard to remote servers

#226

Post by cesarb »

sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

> If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them.

That used to be viable back in the late 1990s and early 2000s when I first used Debian. It would take an afternoon of going through all the packages in dselect (does anyone here still remember dselect?) and marking the ones you wanted to install, and around the same amount of time going through every option on the kernel's menuconfig to precisely tailor the kernel to your specific hardware configuration (things were much less dynamic back then).

Nowadays, there are simply too many packages and kernel configuration options to go through (also, does anyone still use dselect?).

Re: StarDict sends X11 clipboard to remote servers

#227

Post by sim7c00 »

jacquesm wrote: post #31
sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

Such responses to me are proof of malicious intent.

i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-.

how many times does everyone need to be totally compromised by some shitty software before people start to care?

innocent individuals each days are suffering hacks and malicious interactions. people are losing their livelihoods. companies are getting shutdown... what more need to happen?? :S

Re: StarDict sends X11 clipboard to remote servers

#228

Post by runarberg »

voidUpdate wrote: post #174
wolfi1 wrote: post #147

Earlier quoted context omitted.

[flagged]

There are probably a non-zero amount of people who are older than 20 who have not read the hitchhikers guide, or don't recall some parts of it. For example, me

Somebody is bound to be one of today’s lucky 10,000 https://xkcd.com/1053/

Re: StarDict sends X11 clipboard to remote servers

#229

Post by kstrauser »

charcircuit wrote: post #211
mattmanser wrote: post #61

Earlier quoted context omitted.

Because without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.

>People in your coffee shop on the same WiFi could read it. WEP has been deprecated for over 2 decades.

That has no effect on the owner of a malicious access point. HTTP over WPA2 is plaintext again the moment the AP decrypts it.

Re: StarDict sends X11 clipboard to remote servers

#230

Post by sim7c00 »

guappa wrote: post #176
poemxo wrote: post #101

Earlier quoted context omitted.

I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.

Can the problem be fixed without making the software useless?

use TLS enabled dictionary service. if there is none, you dont want this feature. at all. make sure they click through something or explicitly enable is even hard as you cannot assume a user understands the impact. they might not understand what it means to send their data over plaintext, or what someone can do with it.
Post reply on HN