Earlier quoted context omitted.
Even if it's "legit", it shouldn't be using unencrypted HTTP.
Why? Should it use the dict protocol, then?
How about HTTPS?
StarDict sends X11 clipboard to remote servers
51–60 of 350 posts
Re: StarDict sends X11 clipboard to remote servers
#52> StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default. StarDict on Wayland has a different issue, it causes a segfault. Sat, 02 Aug 2025: Bug#1003710: stardict crash in gnome with message Segmentation fault https://www.mail-archive.com/debian-bugs-dist@lists.debian.o...
Besides, capturing text from other applications is very much required for various utilities. It's as much of a security feature in Wayland as turning off your computer and never turning it back on is.
Re: StarDict sends X11 clipboard to remote servers
#53Querying a local dictionary on each clipboard seems okay; having a feature to request remote dictionaries is okay; making it easy to combine both is dubious but understandable (would be better off as a special flag); but having them combined by default? That's pretty much malicious.
[flagged]
There definitely seems to be a cultural difference when it comes to privacy expectations from Chinese companies and western companies. Doesn't mean it's okay to do this kind of thing in a Debian package, of course, but I can understand how this could've happened.
Re: StarDict sends X11 clipboard to remote servers
#54Earlier quoted context omitted.
Such responses to me are proof of malicious intent.
While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs.
Intent or not, that developer is a risk to the project.
Re: StarDict sends X11 clipboard to remote servers
#55Querying a local dictionary on each clipboard seems okay; having a feature to request remote dictionaries is okay; making it easy to combine both is dubious but understandable (would be better off as a special flag); but having them combined by default? That's pretty much malicious.
[flagged]
It's malicious intent! The developer isn't a kid, they're releasing the software for world wide use. It's a simple thing, do not send private data to remote servers without explicitly asking the user!
Re: StarDict sends X11 clipboard to remote servers
#56It's really difficult to not assume malice with something like this. From the maintainer: > The stardict has "Scan" function, when user enable this function, after user select some text, it will trigger stardict do translate for this selected text... Why the user selects some confidential data to query dictionary?
Would be funny if they couldn't tell that the text in a foreign language is confidential... maybe it's stamped "秘密".
"Sir, we have intel, the enemy is having translation server errors."
Re: StarDict sends X11 clipboard to remote servers
#57> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…
At some point I started running gui apps without network access, first with firejail and then bubblewrap. This was before flatpak became a thing. I still use collection of bash scripts that built up over time to run applications in sandbox.
Re: StarDict sends X11 clipboard to remote servers
#58Earlier quoted context omitted.
Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-know…
> I bet there's some cool way to do this with zero-knowledge or homomorphic cryptography though!
The code for which would almost certainly be larger than a fully local dictionary for any human language.
Re: StarDict sends X11 clipboard to remote servers
#59My personal security tolerance means that I have multiple levels of firewalls and blockers: network, dns, device, and browser. It's also why I find myself scanning my DNS traffic (pihole), and running OpenSnitch.
Whether malicious or not, to me isn't the point. The point is that I, as an individual deserve the illusion of control over my data and communication. I have neither the time, nor inclination to read all release notes. Furthermore, as someone who has spent enough time writing code - I recognize that humans make mistakes and don't always update them with salient details. All the automation in the world, and AI (yes, I've tried AI for release notes) just doesn't help.
Re: StarDict sends X11 clipboard to remote servers
#60> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…
That stood out to me as well. It's a sad world when people expect even simple functionality to be a live service.