Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

311–320 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#311

Post by jacquesm »

thewebguyd wrote: post #271
sim7c00 wrote: post #227

Earlier quoted context omitted.

i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. how many times does everyone need to be totally compromised by some shitty software before people start to care? innocent individuals each days are suffering hacks and malicious interactions. people are losing their livelihoods. companies are getting shutdown..…

> i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. LLMs are only going to make this worse. We're going to see a plethora of vibe coded slop everywhere.

But think of the money saved!!

Re: StarDict sends X11 clipboard to remote servers

#312

Post by piperswe »

yorwba wrote: post #139
kazinator wrote: post #30

Earlier quoted context omitted.

I's a generational thing. I would guess that someone who expects applications to phone home, on the off chance that they are actually otherwise local, is likely someone pretty young who hasn't lived in a world of locally installed software that doesn't talk to anything. If we search for the author's bio, that seems to check out. They are a well-credentialed CS person; obviously they know that dictionary programs such…

For many languages, there simply isn't a comprehensive dictionary file that could be redistributed legally as part of a free-software offline dictionary application. You either settle for a few thousand words put together by a handful of volunteers, or you redistribute a commercial dictionary illegally, or you have to connect to an online service to provide sufficient coverage legally.

Wiktionary is massive with 1.4M English entries [1] (3x the size of the Merriam Webster's Unabridged dictionary [2], though with a lower average quality), and CC-BY-SA-licensed[3]

[1]: https://en.wiktionary.org/wiki/Wiktionary:Statistics [2]: https://www.merriam-webster.com/help/faq-how-many-english-wo... [3]: https://en.wiktionary.org/wiki/Wiktionary:Copyrights

Re: StarDict sends X11 clipboard to remote servers

#313

Post by Terr_ »

poemxo wrote: post #101
npteljes wrote: post #95

Earlier quoted context omitted.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.

Right, there are times where the "algorithm" falls over because of pathological inputs.

Re: StarDict sends X11 clipboard to remote servers

#314

Post by jcelerier »

kazinator wrote: post #30
CamouflagedKiwi wrote: post #12

> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…

I's a generational thing. I would guess that someone who expects applications to phone home, on the off chance that they are actually otherwise local, is likely someone pretty young who hasn't lived in a world of locally installed software that doesn't talk to anything. If we search for the author's bio, that seems to check out. They are a well-credentialed CS person; obviously they know that dictionary programs such…

> I's a generational thing

... Is it? Dictionary apps have been working like this for more than twenty years. Babylon Pro of which stardict is pretty much a clone was doing this with already millions of users in the year 2000! Kindles work like that!

Re: StarDict sends X11 clipboard to remote servers

#315

Post by zahlman »

DonHopkins wrote: post #307
zahlman wrote: post #180

Earlier quoted context omitted.

[flagged]

[flagged]

I'm not making any such point. I am, however, pointing out that your posts here clearly have much more to do with your personal grudges than with the many-eyes principle itself.

But also, how racist ESR is or isn't is completely and utterly irrelevant to how security works in FOSS.

Re: StarDict sends X11 clipboard to remote servers

#316

Post by paffdragon »

olejorgenb wrote: post #305
paffdragon wrote: post #194

Earlier quoted context omitted.

> You're just an impatient paranoid, easily jumping to conclusions. You should be ashamed for spreading false information. Thank you for your kind words, please look at the HN comment guidelines when you have a chance. Your point would have been an excellent correction if shared thoughtfully, but it's all negated by the name calling and personal attacks.

IIRC, the GP claimed clipboard sharing between Samsung devices only happens over the local network

Yes, and would have been great to discuss that in a civil way.

Samsung says you need to have the devices on the same Samsung account, same WiFi with Bluetooth enabled in https://www.samsung.com/us/support/answer/ANS10003445/. But I couldn't find more details on how the actual communication happens and if anything leaves the local network. The Samsung article does not go into details how this works, it does not even say explicitly that it uses the local network only. I tried to search for it, but Googling failed me on this.

But I was able to disable that sharing feature, so that isn't my main complaint, it's their clipboard data collection - [1], [2], [3]

[1]: https://cybersecuritynews.com/samsung-one-ui-security-flaw/

[2]: https://www.tomsguide.com/computing/online-security/samsung-...

[3]: https://windowsforum.com/threads/samsung-clipboard-security-...

Re: StarDict sends X11 clipboard to remote servers

#317

Post by amiga386 »

anonymars wrote: post #283
amiga386 wrote: post #277

Earlier quoted context omitted.

Freedom is the freedom to say rm -rf /* and accept the consequences. If you want to give someone else control over what you can and can't do with your machine, iOS is over there -->

False dichotomy. Why should I expect that merely installing a dictionary will silently opt me in to sending everything in my clipboard to some third party? You don't need some strawman tyrant to want it to require a user opt-in if that's what you really want to do

You can expect that any software might do anything, either because of a bug or because it's intentional, and you won't know until you see it happen. It's why the major FOSS licenses say things like THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

You can want software to be well behaved, and in most cases it is. But if you want some level of assurance that the software is behaved as you'd like it, some requirement in law that the software is not allowed to exist unless it meets your requirements, or the platform it runs on is neutered so it literally can't do the thing you don't want it to do -- that's where the tyrant comes in.

Re: StarDict sends X11 clipboard to remote servers

#318

Post by more_corn »

npteljes wrote: post #95
jacquesm wrote: post #31

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

No. The simplest answer is that they’re deliberately and maliciously exfiltrating data. The other explanation requires more hoops.

Re: StarDict sends X11 clipboard to remote servers

#319

Post by anonymars »

amiga386 wrote: post #317
anonymars wrote: post #283

Earlier quoted context omitted.

False dichotomy. Why should I expect that merely installing a dictionary will silently opt me in to sending everything in my clipboard to some third party? You don't need some strawman tyrant to want it to require a user opt-in if that's what you really want to do

You can expect that any software might do anything, either because of a bug or because it's intentional, and you won't know until you see it happen. It's why the major FOSS licenses say things like THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. You can want software to be well behav…

Again, false dichotomy. If Debian's maintainers don't put things in the package manager with dodgy behavior, that's not a walled garden like iOS

Not having to check your cereal for razor blades is also a freedom

Re: StarDict sends X11 clipboard to remote servers

#320

Post by amiga386 »

anonymars wrote: post #319
amiga386 wrote: post #317

Earlier quoted context omitted.

You can expect that any software might do anything, either because of a bug or because it's intentional, and you won't know until you see it happen. It's why the major FOSS licenses say things like THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. You can want software to be well behav…

Again, false dichotomy. If Debian's maintainers don't put things in the package manager with dodgy behavior, that's not a walled garden like iOS Not having to check your cereal for razor blades is also a freedom

You're asking Debian to check out all aspects of a program and hold them liable if it does something you don't like, or their volunteers does something you don't like.

That's not what Debian is doing. Debian is asking for volunteers to package the world's free software, also written by volunteers. They have their own checklists, your "dodgy behaviour" concerns aren't on it. Confirming the software meets your expectations depends on you evaluating it. If it doesn't, you can then volunteer your time to write them a bug report, which they might or might not accept and fix.

Post reply on HN