StarDict sends X11 clipboard to remote servers • Hacker News Board

Re: StarDict sends X11 clipboard to remote servers

#341

Post by sneak » Wed, Aug 13, 2025, 1:35 PM UTC

koito17 wrote: post #292

sneak wrote: post #284

Apple did something similar in 2015: CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://lists.apple.com/archives/security-announce/2015/Aug/... You had to three-finger press to trigger it, though. Similarly, it used unencrypted HTTP. I reported it and it was fixed to use TLS. The dev defending this unencrypted behavior is really wild, though.

Most Chinese sites do not use HTTPS. In fact, TLS 1.3 traffic seems to be completely blocked within China's internet.[1] The decision to use plain HTTP is only strange from a Western viewpoint. Note: I am not defending this behavior. I still remember the era of ISPs injecting content into webpages. But it's important to keep in mind our subset of the world does not reflect the rest of the world. [1] https://news.ycom…

It does reflect the rest of the world; China is the extreme outlier here.

Also, accessing GitHub from within mainland China works, so TLS is not completely banned.

Re: StarDict sends X11 clipboard to remote servers

#342

Post by Telaneo » Wed, Aug 13, 2025, 3:32 PM UTC

ASalazarMX wrote: post #294

avhception wrote: post #44

Earlier quoted context omitted.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

It's clearly a defensive excuse, as it is extremely unrealistic to expect final users to read all the docs of all the dependencies of a Linux distro. It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's. It could be that they were caught with their pants down and posted an ill-thought response, but I'd lean strongly towards malice with su…

> It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's.

I agree a lot with this. You're supposed to trust your distributions packages. If you can't trust your distro, who can you trust? If you don't, find one you do trust, as that's a viable alternative. If none are trustworthy to you, then the only real option is to become your own package maintainer and have fun with Linux From Scratch.

Re: StarDict sends X11 clipboard to remote servers

#343

Post by dotancohen » Wed, Aug 13, 2025, 4:24 PM UTC

JumpCrisscross wrote: post #170

avhception wrote: post #44

Earlier quoted context omitted.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

> it's still a far cry from "proof of malicious intent" Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion.

  > Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion.

We expel people for different values now? I'm not Christian, should I be expelled?

Is there a defined set of values that one must uphold, or at least believe in theoretically, to be a welcome member?

Re: StarDict sends X11 clipboard to remote servers

#344

Post by 1vuio0pswjnm7 » Wed, Aug 13, 2025, 6:34 PM UTC

sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

"If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them."

Another option might be to reduce the amount of software one is "blindly"^1 using and relying upon

For example, I have been making own Linux distribution, not following Linux from Scratch (although that is a useful reference)

This is for both learning but also reliability and robustness purposes (where "robustness" includes ability to recover quickly from losing everything)

IME starting from scratch gives a better appreciation for the "inconveniences" that maintainers must endure

"Inconvenience" may be putting it mildly

Certainly, the inconvenience varies depending on the software

Some software builds even on the most deficient/broken installations

Other software is absurdly difficult to compile, often due to minor oversights, sometimes due to obivous carelessness

The wild inconsistencies from one project to another is itself part of the inconvenience

The ease with which software can be compiled by me, and presumably anyone else, on any computer, including underpowered ones, with minimal dependencies, is among the factors I consider when choosing whether to rely on any particular software

1. Here "blindly" means the user has zero curiosity about where it comes from or how it works

No comment on this particular software or the Debian maintainer

I have up on X11 many years ago

I never liked that Debian maintainers make subjective, opinionated changes to other peoples' software, especially since it seems like the majority of Debian users do not compile from source

Re: StarDict sends X11 clipboard to remote servers

#345

Post by rangerelf » Thu, Aug 14, 2025, 6:17 PM UTC

guappa wrote: post #334

rangerelf wrote: post #266

Earlier quoted context omitted.

Does it matter? Will the existence or lack thereof excuse the absolute lack of security and privacy this package exhibits? And the lack of interest from the developer?

Yes it matters. Something that doesn't exist cannot be used. Any other insightful comment you wish to make?

Don't be dense.

At least try to keep up with the main concern: "sending potentially private or security impacting information in plaintext across the internet".

"Does not exist blah blah"

That has to be one of the most inane replies I've read in a while.

Re: StarDict sends X11 clipboard to remote servers

#346

Post by JumpCrisscross » Sat, Aug 16, 2025, 7:03 PM UTC

dotancohen wrote: post #343

JumpCrisscross wrote: post #170

Earlier quoted context omitted.

> it's still a far cry from "proof of malicious intent" Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion.

> Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion. We expel people for different values now? I'm not Christian, should I be expelled? Is there a defined set of values that one must uphold, or at least believe in theoretically, to be a welcome member?

> We expel people for different values now?

Yes, that's what core values mean. If they're not embraced by everyone, they cease to be core.

If X11 tolerates developers who think piping data unseen to remote servers is okay, the project as a whole ceases to be trustworthy.

> I'm not Christian, should I be expelled?

From a listserv? No. From, like, a religious group? Maybe.

Re: StarDict sends X11 clipboard to remote servers

#347

Post by rapiz » Sun, Aug 17, 2025, 2:19 PM UTC

Some context for ppl who are not paranoid, it's a very old software and not very maintained since very long time ago. I'm pretty sure HTTPS was not common at the time. And the selection scanning a very common and wanted feature in many alternatives for windows, browsers, etc.

If there's anything we can learn from it - don't use obsolete software.

Re: StarDict sends X11 clipboard to remote servers

#348

Post by rapiz » Sun, Aug 17, 2025, 2:44 PM UTC

jacquesm wrote: post #75

avhception wrote: post #44

Earlier quoted context omitted.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data. Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't…

And yes, that IS the expected behavior.

Select to translate is almost a standard feature for translation software. Not sure if the situation gets better now, but back then the software was written, using clipboard as temporary storage is a very robust and maybe the only way to implement such feature.

Trivia: It's likely sending Ctrl+C and reading clipboard to get the selected text. No easy cross-platform API for this lol.

Also note that the software is very old and poorly maintained.

Re: StarDict sends X11 clipboard to remote servers

#349

Post by M95D » Wed, Aug 20, 2025, 7:19 AM UTC

const_cast wrote: post #280

M95D wrote: post #179

In my Windows, it wouldn't be a problem. The firewall I use would pop up for any new program that tries to connect somewhere. But Linux doesn't have a per-program firewall. ... and even if it did, there's no way to do popups/questions from the kernel, ... and even if there was, most programs would just run curl or wget or openssl. That would mean a popup for each and every connection attempt through those programs.

Opensnitch is really good on Linux

It requires having dbus, it's for the popups, one of the things I said the kernel doesn't have.

But unfortunately, IMHO, dbus is a much bigger privacy risk than not having a per-app firewall - it broadcasts everything that happens in the computer to any program that would listen. I hate programs communicating to each other without my consent even more than I hate programs connecting to the internet without my consent.

Re: StarDict sends X11 clipboard to remote servers

#350

Post by const_cast » Sun, Aug 31, 2025, 5:05 PM UTC

M95D wrote: post #349

const_cast wrote: post #280

Earlier quoted context omitted.

Opensnitch is really good on Linux

It requires having dbus, it's for the popups, one of the things I said the kernel doesn't have. But unfortunately, IMHO, dbus is a much bigger privacy risk than not having a per-app firewall - it broadcasts everything that happens in the computer to any program that would listen. I hate programs communicating to each other without my consent even more than I hate programs connecting to the internet without my consent…

Dbus is just for IPC. Its up to the apps and developers to choose how to set up their interfaces. Sensitive interfaces do have auth. Its just COM but better, and allows for some great automation.