Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StarDict sends X11 clipboard to remote servers

lwn.net

Post reply on HN
Print view View original

71–80 of 350 posts

Re: StarDict sends X11 clipboard to remote servers

#71

Post by waterhouse »

CamouflagedKiwi wrote: post #12

> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…

  ~> wc -cl /usr/share/dict/words
  235976 2493885 /usr/share/dict/words
One might even expect a program to use a common Unix preinstalled dictionary.

Re: StarDict sends X11 clipboard to remote servers

#72

Post by account42 »

pabs3 wrote: post #2

There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues Luckily there are things like opensnitch that can block some of these issues: https://github.com/evilsocket/opensnitch

Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet. The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".

Re: StarDict sends X11 clipboard to remote servers

#73

Post by jacquesm »

CorrectHorseBat wrote: post #46
jacquesm wrote: post #31

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

Malicious intent written in the package description? I would think that really unlikely. I think it's just a cultural difference. Sogou, a super popular Chinese input program for Windows iOS and Android does the same with everything you type and nobody cares.

I'd say that having terms of service that document your shady behavior whilst at the same time not making this obvious in the UI in any way is a tried and true (corporate) malware pattern.

Just because Microsoft did it that doesn't make it a valid defense, in fact it shows the opposite (after all, they too did not have the best interests of their users at heart). The fact that the recipient of the data sits on the other side of the GFW and that clipboards can contain very interesting data you really should wonder about the intentions of the author, they do not get the benefit of the doubt. In fact, open source software that to all intents and purposes looks like it runs locally but pumps your (private) data out without your consent is a very large red flag to me: it gains access to data that otherwise likely would never be found in the wild. At a minimum this is a fairly serious GDPR violation.

Re: StarDict sends X11 clipboard to remote servers

#74

Post by account42 »

est wrote: post #37

it looks like a serious "privacy violation" for English-only users. But for many ESL or non-English users out there, the "translation" is a must. On Windoes, I remember some translation programs go extreme, they hijack all GDI calls and scan for all strings on GUIs trying to translate and replace them inline. Local dictionary were pretty limited so many of them use online services. What happens when user input someth…

> But for many ESL or non-English users out there, the "translation" is a must.

As an ESL user, I vehemently disagree. You're only going to need translations as long as you keep relying on translations. Like it or not but English is the lingua franca of the computing age and you're doing yourself a disservice if you don't learn it.

Re: StarDict sends X11 clipboard to remote servers

#75

Post by jacquesm »

avhception wrote: post #44
jacquesm wrote: post #31

Earlier quoted context omitted.

Such responses to me are proof of malicious intent.

While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".

We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data.

Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't even know what you've lost.

Re: StarDict sends X11 clipboard to remote servers

#77

Post by dkiebd »

waterhouse wrote: post #71
CamouflagedKiwi wrote: post #12

> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like…

~> wc -cl /usr/share/dict/words 235976 2493885 /usr/share/dict/words One might even expect a program to use a common Unix preinstalled dictionary.

"words" is nothing but a list of words. It does not contain definitions for those words, which is what one expects from a dictionary.

Re: StarDict sends X11 clipboard to remote servers

#78

Post by jraph »

sugarpimpdorsey wrote: post #29

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descript…

“the plans and the demolition orders have been on display at the local planning office on Alpha Centauri for fifty of your Earth years. If you can't be bothered to take an interest in local affairs...”

https://www.youtube.com/watch?v=Z1Ba4BbH0oY

Re: StarDict sends X11 clipboard to remote servers

#79

Post by bayindirh »

account42 wrote: post #70
bayindirh wrote: post #34

Earlier quoted context omitted.

I'll politely disagree. First of all, "Recommends" is reserved for packages which enhance the functionality of the package you're installing. Without these the package will not break, but some very useful functionality might be disabled. The package-class you're talking about is "suggests", IOW, "these packages might also be useful for you, wanna look?" section. These are not installed by default already. On the othe…

I agree that recommends makes sense but this is a bullshit argument: > On the other hand, apt and aptitude provides previews before doing something. You don't have to accept them. In aptitude's case, you can fine tune before the final commit, even. You can't expect the average user to understand the entire dependency tree and read the description of dozens of random packages that the average program pulls in. RTFM is…

I don't expect average user to read an entire dependency tree. However, apt and aptitude does a relatively good job of explaining their actions' reasons.

Let me rephrase:

    1. Installation of recommended packages is a good default for the average user, because it provides functionality they expect.
    2. If the user is not happy with what's happening, changing defaults are not hard.
IOW, if you don't like how your system behaves, read the documents. Otherwise, I argue, current defaults is good for the benefit of the newcomer and average Linux user. If you are at a point where you are caring which package is doing what, you're leaving "average user / beginner" realm.

In the case of StarDict, as I noted elsewhere, I think the developer's answer is fishy, or ill-informed at least.

Re: StarDict sends X11 clipboard to remote servers

#80

Post by lupusreal »

CorrectHorseBat wrote: post #62
dd_xplore wrote: post #55

Earlier quoted context omitted.

It's malicious intent! The developer isn't a kid, they're releasing the software for world wide use. It's a simple thing, do not send private data to remote servers without explicitly asking the user!

In your eyes maybe (and mine for the record), but different people have different values and expectations of what is privacy.

The "Chinese values" excuse doesn't fly. We're not talking about a random Chinese person, we're talking about a Debian packager. Debian packagers should have values in line with the Debian project's ethos. It's difficult to imagine how somebody to whom Debian's values are alien could even accidentally stumble their way into the position of being a Debian packager.
Post reply on HN