I honestly don't think x11 is the primary problem. The package maintainer not thinking it's a big deal to send this data over http by default wouldn't be a good situation on Wayland either. They wouldn't get the clipboard but they're still not responsible. I presume this program also has full access to the filesystem.
StarDict sends X11 clipboard to remote servers
291–300 of 350 posts
Re: StarDict sends X11 clipboard to remote servers
#292Apple did something similar in 2015: CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://lists.apple.com/archives/security-announce/2015/Aug/... You had to three-finger press to trigger it, though. Similarly, it used unencrypted HTTP. I reported it and it was fixed to use TLS. The dev defending this unencrypted behavior is really wild, though.
Most Chinese sites do not use HTTPS. In fact, TLS 1.3 traffic seems to be completely blocked within China's internet.[1] The decision to use plain HTTP is only strange from a Western viewpoint. Note: I am not defending this behavior. I still remember the era of ISPs injecting content into webpages. But it's important to keep in mind our subset of the world does not reflect the rest of the world.
Re: StarDict sends X11 clipboard to remote servers
#293Earlier quoted context omitted.
For the uninformed: this is a quote from The Hitchhiker's Guide to the Galaxy.
[flagged]
Ah, yes, everything I know is a basic common knowledge and if someone do not know anything from my list should be checked for some problems.
Be it a minor SciFi flick in a written form or some SciFi flick in a live-action form[0]
FYI HHTG is big[1] in anglosphere and known mostly to SciFi enthusiasts in other parts of the world.
[0] https://news.ycombinator.com/item?id=44287254
[1] as big as you want, of course
Re: StarDict sends X11 clipboard to remote servers
#294Earlier quoted context omitted.
Such responses to me are proof of malicious intent.
While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
It's clearly a defensive excuse, as it is extremely unrealistic to expect final users to read all the docs of all the dependencies of a Linux distro. It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's.
It could be that they were caught with their pants down and posted an ill-thought response, but I'd lean strongly towards malice with such a poor defense, it borders on confession. Clipboards are one of the most critical privacy/security features, you don't ever want to leak them unintentionally.
Did we already forget about the XZ Utils backdoor? There have to be multiple efforts to infiltrate backdoors in Linux going right now.
Re: StarDict sends X11 clipboard to remote servers
#295Earlier quoted context omitted.
I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.
Not only is it outdated, the Nolnah's razor (reverse form of Hanlon) is more likely to be true nowadays: "Never attribute to incompetence that which is adequately explained by malice".
The bad actors have become too good at acting like well-meaning klutzes.
Re: StarDict sends X11 clipboard to remote servers
#296Earlier quoted context omitted.
> pressured Maybe incentivized? $1000? $10000? Would be interesting to hear from the developer himself.
>nor do I think that they gain any advantage of it
I guess the companies receiving all this clipboard traffic are absorbing operational costs to humbly provide this surreptitious service to the world for free, and the package maintainer only wants to help them realize their mission.
We truly live in an utopia!
Re: StarDict sends X11 clipboard to remote servers
#297Earlier quoted context omitted.
I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.
Not only is it outdated, the Nolnah's razor (reverse form of Hanlon) is more likely to be true nowadays: "Never attribute to incompetence that which is adequately explained by malice".
Wholesale violations of legal and social norms as the secret sauce that will give your company a leg up? Sure if we get caught the stockholders will have to pay to keep our asses out of jail. But we'll get to keep our share of the loot.
Yeah this is the world we now live in.
Re: StarDict sends X11 clipboard to remote servers
#298I don't understand why the whole thing isn't local. A comprehensive Chinese dictionary has less than 400k words. Even at 1k per word that's less than 400MB. It's just poor design to make something require a network connection when it could work offline locally.
Then we should have a copy-left dictionary first.
Re: StarDict sends X11 clipboard to remote servers
#299Docs is obviously designed to be misleading. If I would design a malware, this is how I would do it. Plausible deniability. Don’t fool yourself. Kick this shit, and people who develop it, out of debian asap.
Re: StarDict sends X11 clipboard to remote servers
#300Can someone recommend a completely local English-language dictionary for Debian?
I recently found wordnet through an offline dictionary/thesaurus program and thought it was a pretty neat project. https://wordnet.princeton.edu/
For my use case I was more interested in the data than the application and so never installed it and am unable to comment on how usable it is, but will include a link if you want to look. https://sourceforge.net/projects/artha/