Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

261–270 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#261

Post by tremon »

avhception wrote: post #23

While I have a lot of respect for the effort that goes into Debian, I always disliked this kind of "maximalism" from the package manager. Oh, the user wants "foo"? Let's install every software that might be even remotely useful somehow in combination with foo! Oh there is a network daemon in there? Fantastic, let's start it immediately! I know that there is a flag to disable the installation for "recommended" package…

I don't have a problem with --install-recommends being the default. I think it's a fine distinction to have Recommends be "most of our users will want these" and "this package provides some niche feature that most users won't need".

However, like you, I do have a problem with maintainers abusing the Recommends: field to further their own world domination plans. There is no valid reason that installing an archive tool should mandate a specific init system (looking at you, file-roller and gnome team in general).

Re: StarDict sends X11 clipboard to remote servers

#262

Post by rangerelf »

avhception wrote: post #44
jacquesm wrote: post #31

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

I disagree; it's basically lawyerspeak for "sucks to be you".

If one is expected to go through all the documentation of both the main package and all dependency packages, and also through whatever specific configuration details to your case, just to be able to catch a specific IMPORTANT detail that's not clearly spelled out in the main package, that's malicious.

"A dependency we use captures your clipboard data and sends it to remote servers"

That sentence right there would kill their userbase, so they omit warning you about it. And on top of the "...user should have read the description..." non-apology, "just split the packages, bro".

That's malicious.

Re: StarDict sends X11 clipboard to remote servers

#263

Post by dingnuts »

npteljes wrote: post #95
jacquesm wrote: post #31

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

guy works for a Chinese media company and he's essentially trying to slip a backdoor into Debian systems.

malice & typical CCP behavior IMHO. The responses from the maintainer are unacceptable and he should have his privileges stripped

Re: StarDict sends X11 clipboard to remote servers

#264

Post by bayindirh »

ioasuncvinvaer wrote: post #256
bayindirh wrote: post #254

Earlier quoted context omitted.

From my experience, newbie users are generally more interested in the end result: Their intended packages are working, and what that package is doing. They are not yet interested in all the libraries required and whatnot. As they get familiar with their systems, they get interested in what makes the particular package or software tick. Then, the digging starts. At that point they are already pretty proficient with th…

I guess sou just have a weird definition of "what a software does" means. Because to it is exactly about the end product.

If wondering about why some libraries are installed as a part of an application, and having a desire to learn the function of a library in that context is a "weird" definition of "wondering about what software does", then yes.

Libraries does matter. =)

Re: StarDict sends X11 clipboard to remote servers

#265

Post by [deleted] »

charcircuit wrote: post #211
mattmanser wrote: post #61

Earlier quoted context omitted.

Because without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.

>People in your coffee shop on the same WiFi could read it. WEP has been deprecated for over 2 decades.

[deleted]

Re: StarDict sends X11 clipboard to remote servers

#266

Post by rangerelf »

guappa wrote: post #236
sim7c00 wrote: post #230

Earlier quoted context omitted.

use TLS enabled dictionary service. if there is none, you dont want this feature. at all. make sure they click through something or explicitly enable is even hard as you cannot assume a user understands the impact. they might not understand what it means to send their data over plaintext, or what someone can do with it.

Does this service exist?

Does it matter?

Will the existence or lack thereof excuse the absolute lack of security and privacy this package exhibits? And the lack of interest from the developer?

Re: StarDict sends X11 clipboard to remote servers

#267

Post by zamadatix »

charcircuit wrote: post #211
mattmanser wrote: post #61

Earlier quoted context omitted.

Because without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.

>People in your coffee shop on the same WiFi could read it. WEP has been deprecated for over 2 decades.

Not all guest Wi-Fi uses a PSK. In general, assuming all networks will already be encrypted along each hop to the server is a losing assumption for users.

Re: StarDict sends X11 clipboard to remote servers

#268

Post by delfinom »

dkiebd wrote: post #77
waterhouse wrote: post #71

Earlier quoted context omitted.

~> wc -cl /usr/share/dict/words 235976 2493885 /usr/share/dict/words One might even expect a program to use a common Unix preinstalled dictionary.

"words" is nothing but a list of words. It does not contain definitions for those words, which is what one expects from a dictionary.

I wonder where one files a bug report that it's misusing "dict" under "words"

Re: StarDict sends X11 clipboard to remote servers

#269

Post by zamadatix »

yorwba wrote: post #139
kazinator wrote: post #30

Earlier quoted context omitted.

I's a generational thing. I would guess that someone who expects applications to phone home, on the off chance that they are actually otherwise local, is likely someone pretty young who hasn't lived in a world of locally installed software that doesn't talk to anything. If we search for the author's bio, that seems to check out. They are a well-credentialed CS person; obviously they know that dictionary programs such…

For many languages, there simply isn't a comprehensive dictionary file that could be redistributed legally as part of a free-software offline dictionary application. You either settle for a few thousand words put together by a handful of volunteers, or you redistribute a commercial dictionary illegally, or you have to connect to an online service to provide sufficient coverage legally.

I could buy the idea of the plugin system itself being desired (e.g. maybe I even want english definitions from Merriam-Webster or something because I like their style more than the open source database) but I think that's separate from what an app does by default. Especially on something like Debian, one should expect a FOSS-first approach whenever reasonable, and for >99% of users the reasonable default is a local dictionary.

Re: StarDict sends X11 clipboard to remote servers

#270

Post by sejje »

rangerelf wrote: post #262
avhception wrote: post #44

Earlier quoted context omitted.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

I disagree; it's basically lawyerspeak for "sucks to be you". If one is expected to go through all the documentation of both the main package and all dependency packages, and also through whatever specific configuration details to your case, just to be able to catch a specific IMPORTANT detail that's not clearly spelled out in the main package, that's malicious. "A dependency we use captures your clipboard data and s…

> That sentence right there would kill their userbase

No, it wouldn't. People don't take privacy very seriously.

Post reply on HN