4 ms·

In my opinion, nobody (edit: who values their privacy) should use Deluge. There's an issue where proxy settings are ignored: https://dev.deluge-torrent.org/tick

by bartvk 4y ago

In my opinion, nobody (edit: who values their privacy) should use Deluge. There's an issue where proxy settings are ignored: https://dev.deluge-torrent.org/ticket/2149 https://dev.deluge-torrent.org/ticket/2149 It's been open since 10 years, and this is not a great situation for a torrent client. Where torrents are concerned, proxies are explicitly used to protect privacy. Even in this very topic, someone said they were happy with the SOCKS proxy option in Deluge, when this option (edit: possibly) does nothing.

dewey 4y ago
> In my opinion, nobody should use Deluge. That's pretty harsh for the client just not supporting one non-essential feature. Many power users of Deluge or other torrent clients run it on seedboxes where a proxy isn't needed and would also negatively impact the speed.
- bartvk 4y ago
  It's not about whether the client supports one non-essential feature or not. It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something.
  - wildmanx 4y ago
    > It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something. Which means that everybody who either doesn't use a proxy or does not care whether it's exposed what they are downloading can happily use Deluge. Using the term "nobody" you are exaggerating quite a bit, don't you think? Instead of complaining and demanding that others fix something for you for free who are not affected by it, please consider contributing a fix yourself.
    - Fnoord 4y ago
      You can route a BitTorrent client through a VPN. I do this with Docker + rtorrent + Wireguard. I agree silently ignoring proxy setting is not cool but assuming it is used for privacy reasons is a stretch. I'm glad it avoids people route Deluge data through Tor though that also would not be the sole purpose.
    - bartvk 4y ago
      Thanks for pointing it out — yes, using “nobody” is exaggerating and I’ve edited it. Note that I’m not demanding anything. Or complaining that it isn’t fixed. How could I? The person developing it, may have their reasons which I don’t know about. However I am pointing out the issue, because there are more secure alternatives out there, if privacy is what you value.
  - dewey 4y ago
    There's 10 comments by the main developer (Cas) on that specific issue. I wouldn't call that "silently ignores". I support him on Patreon (https://www.patreon.com/deluge_cas https://www.patreon.com/deluge_cas) where he sometimes posts updates but it's clear that he's very busy with other things (Including going through an illness) so I'm not blaming some open source maintainer for picking up a 10 year old, apparently hard to reproduce issue with a total of 45 comments. The client can be used just fine, except for a small buggy behaviour in case if you are using a proxy which likely isn't used by the majority of users.
    - smcl 4y ago
      The application lets you configure a proxy, and then does not use the proxy. It ignores the proxy configuration without informing you. It silently ignores it. No amount of comments in a bug tracker changes that.
    - bartvk 4y ago
      Oh but I don’t blame him either, it’s not a question of pointing fingers. Saying it’s “likely isn’t used by the majority“ is bad form, in my opinion. You don’t know that. I don’t know either, to be sure, but it makes me personally lose faith in the security aspects of the project.
  - my80thaccount 4y ago
    I think they're ignoring it because in practice it is not much of an issue.
    - bartvk 4y ago
      Some time ago, there was a Russian developer(s) who built a database that logged all IP addresses connecting to swarms. They then built a nice web frontend for it, to make it searchable. That’s how I found my IP address. If you think that’s not much of an issue, that’s okay but I definitely didn’t like it.
      - my80thaccount 4y ago
Galanwe 4y ago
Out of curiosity, which feature of the client uses HTTP? I thought BitTorrent was a protocol on top of e.g. TCP, is it carried inside HTTP by some clients?
- SahAssar 4y ago
  Some trackers use http (if you look at a magnet link and see `&tr=http://mytracker.net http://mytracker.net`), and webseed uses http: https://www.bittorrent.org/beps/bep_0019.html https://www.bittorrent.org/beps/bep_0019.html
- deleted 4y ago
  [deleted]
wildmanx 4y ago
For you and everybody else complaining about this aspect: This is open source software. GPL licensed. It's provided as-is. You are free to use it and express what you think about it, and the maintainers are equally free to do with your opinion whatever they like, which includes ignoring it. Clearly, none of the maintainers found this to be a problem. They likely don't need proxy settings for themselves. And they apparently also don't want to spend the time and energy to fix an issue that they don't have. That doesn't mean it's not an issue. It's just not an issue for them and they choose to do other things in life than fix it for you. Do you really demand somebody who already gave something to you for free to do even more work for free to implement something that they don't need themselves? Why would they do it? To get you to stop complain? It's open source, you are free to go fix it yourself. This is Hacker News, lots of people on here should have the competence to fix this. Yet, in the last 10 years, apparently nobody found it so bad that they fixed it. It is clearly not impacting as many people as you make it sound like. "Nobody should use Deluge" is an unsuitable statement, just because it has an issue in your use case. Many people don't have that use case, and of those who do, nobody bothered to fix it yet. Complaining doesn't fix anything. What needs just as much fixing as the raised issue is your attitude towards open source.
- sph 4y ago
  I hate this philosophy of yours with all my might. When you put something out there, you should strive to do right by your users. It is fine if you do not have time to fix a particular bug, but communication and asking for help should then be your priorities as maintainer. If 10 years of mostly silence on your part have passed, IMHO you have failed to be an effective open source maintainer. I understand that open source doesn't offer you any rights or guarantees, but it does not have to be written in a contract to care about your software and its particular shortcomings. Lastly, if you say a maintainer can do whatever they want with their software, I say that users should be free to be critical of it. There is no attitude in OP, they pointed out that a possibly major security bug still exists and people should be very careful about using it. Being open source doesn't mean nobody should dare criticise you.
  - EdwardDiego 4y ago
deleted 4y ago
[deleted]
my80thaccount 4y ago
This is a really bad look, but I would think that if opsec is important to you, you won't have your proxy configuration in application level settings of a Python app. I think the people who would be concerned about this use system wide VPNs or seed boxes.
- bartvk 4y ago
  SOCKS is sometimes used as an additional layer to privacy. Stock system level VPN will continue without VPN if the VPN server somehow drops the connection.
  - dvzk 4y ago
    If you are limiting the discussion to included stock VPN implementations, doesn’t that basically just include IPsec? Most secure third-party options will drop packets that aren’t destined for an encrypted tunnel, even while not running.
    - bartvk 4y ago
      It's been a long time since I used Deluge and found that bug, but I think you're correct. Nowadays I follow your advice and use a third-party option.
- em-bee 4y ago
  a system wide vpn doesn't always work. in some countries there are apps/websites that only work if they are accessed locally because they block access from outside.
EdwardDiego 4y ago
Welp, it's open source, you've had 10 years to contribute a fix. If you're going to downvote my comment, please explain in a subsequent comment why it's unreasonable to expect that if this is such an egregious bug, someone would've contributed a fix for it? Or at least, a reproducible test case? Given they haven't, it's either not that egregious, or the people complaining are people who feel entitled to take without giving. Which, tbh, probably describes a majority of users of torrent software.
- em-bee 4y ago
  it looks like people are misreading your comment. at least i did, at first. i thought you were piling on, addressing the maintainer, but on closer reading i realized that you were addressing the parent poster. for what it's worth, i think you are absolutely right.
  - EdwardDiego 4y ago
    Well cheers, makes me think you contribute to FOSS too :)
    - em-bee 4y ago
      any opportunity i get. which is sadly not often enough these days.
andrewmackrodt 4y ago
I've been running deluge in Linux since 2019 (version 2.0+, so considerably newer than the bug report) and it appeared to have been using my SOCKS5 proxy settings correctly; I had applied some extra hardening such as disabling natpmp etc, although I'm not sure if those are required. However I don't doubt that these kind of leaks could have happened depending on configuration / bugs etc. Eventually I ended up changing my configuration to run deluge in a VPN container (docker) network namespace so that I could use VPN port forwarding for better speeds (supported by Mullvad).
dvzk 4y ago
It should be removed as an option, but in-application proxy leaks are also common. Application developers are typically not security experts, and built-in proxy implementations are frequently ancient or poorly implemented. Anyone very worried about privacy should be encouraged to use an audited modern alternative that tunnels all traffic from an interface or VM.

by bartvk 4y ago

dewey 4y ago

> In my opinion, nobody should use Deluge. That's pretty harsh for the client just not supporting one non-essential feature. Many power users of Deluge or other torrent clients run it on seedboxes where a proxy isn't needed and would also negatively impact the speed.

bartvk 4y ago
It's not about whether the client supports one non-essential feature or not. It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something.
- wildmanx 4y ago
  > It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something. Which means that everybody who either doesn't use a proxy or does not care whether it's exposed what they are downloading can happily use Deluge. Using the term "nobody" you are exaggerating quite a bit, don't you think? Instead of complaining and demanding that others fix something for you for free who are not affected by it, please consider contributing a fix yourself.
  - Fnoord 4y ago
    You can route a BitTorrent client through a VPN. I do this with Docker + rtorrent + Wireguard. I agree silently ignoring proxy setting is not cool but assuming it is used for privacy reasons is a stretch. I'm glad it avoids people route Deluge data through Tor though that also would not be the sole purpose.
  - bartvk 4y ago
    Thanks for pointing it out — yes, using “nobody” is exaggerating and I’ve edited it. Note that I’m not demanding anything. Or complaining that it isn’t fixed. How could I? The person developing it, may have their reasons which I don’t know about. However I am pointing out the issue, because there are more secure alternatives out there, if privacy is what you value.
- dewey 4y ago
  There's 10 comments by the main developer (Cas) on that specific issue. I wouldn't call that "silently ignores". I support him on Patreon (https://www.patreon.com/deluge_cas https://www.patreon.com/deluge_cas) where he sometimes posts updates but it's clear that he's very busy with other things (Including going through an illness) so I'm not blaming some open source maintainer for picking up a 10 year old, apparently hard to reproduce issue with a total of 45 comments. The client can be used just fine, except for a small buggy behaviour in case if you are using a proxy which likely isn't used by the majority of users.
  - smcl 4y ago
    The application lets you configure a proxy, and then does not use the proxy. It ignores the proxy configuration without informing you. It silently ignores it. No amount of comments in a bug tracker changes that.
  - bartvk 4y ago
    Oh but I don’t blame him either, it’s not a question of pointing fingers. Saying it’s “likely isn’t used by the majority“ is bad form, in my opinion. You don’t know that. I don’t know either, to be sure, but it makes me personally lose faith in the security aspects of the project.
- my80thaccount 4y ago
  I think they're ignoring it because in practice it is not much of an issue.
  - bartvk 4y ago
    Some time ago, there was a Russian developer(s) who built a database that logged all IP addresses connecting to swarms. They then built a nice web frontend for it, to make it searchable. That’s how I found my IP address. If you think that’s not much of an issue, that’s okay but I definitely didn’t like it.
    - my80thaccount 4y ago

Galanwe 4y ago

Out of curiosity, which feature of the client uses HTTP? I thought BitTorrent was a protocol on top of e.g. TCP, is it carried inside HTTP by some clients?

SahAssar 4y ago
Some trackers use http (if you look at a magnet link and see `&tr=http://mytracker.net http://mytracker.net`), and webseed uses http: https://www.bittorrent.org/beps/bep_0019.html https://www.bittorrent.org/beps/bep_0019.html
deleted 4y ago
[deleted]

wildmanx 4y ago

For you and everybody else complaining about this aspect: This is open source software. GPL licensed. It's provided as-is. You are free to use it and express what you think about it, and the maintainers are equally free to do with your opinion whatever they like, which includes ignoring it. Clearly, none of the maintainers found this to be a problem. They likely don't need proxy settings for themselves. And they apparently also don't want to spend the time and energy to fix an issue that they don't have. That doesn't mean it's not an issue. It's just not an issue for them and they choose to do other things in life than fix it for you. Do you really demand somebody who already gave something to you for free to do even more work for free to implement something that they don't need themselves? Why would they do it? To get you to stop complain? It's open source, you are free to go fix it yourself. This is Hacker News, lots of people on here should have the competence to fix this. Yet, in the last 10 years, apparently nobody found it so bad that they fixed it. It is clearly not impacting as many people as you make it sound like. "Nobody should use Deluge" is an unsuitable statement, just because it has an issue in your use case. Many people don't have that use case, and of those who do, nobody bothered to fix it yet. Complaining doesn't fix anything. What needs just as much fixing as the raised issue is your attitude towards open source.

sph 4y ago
I hate this philosophy of yours with all my might. When you put something out there, you should strive to do right by your users. It is fine if you do not have time to fix a particular bug, but communication and asking for help should then be your priorities as maintainer. If 10 years of mostly silence on your part have passed, IMHO you have failed to be an effective open source maintainer. I understand that open source doesn't offer you any rights or guarantees, but it does not have to be written in a contract to care about your software and its particular shortcomings. Lastly, if you say a maintainer can do whatever they want with their software, I say that users should be free to be critical of it. There is no attitude in OP, they pointed out that a possibly major security bug still exists and people should be very careful about using it. Being open source doesn't mean nobody should dare criticise you.
- EdwardDiego 4y ago

deleted 4y ago

[deleted]

my80thaccount 4y ago

This is a really bad look, but I would think that if opsec is important to you, you won't have your proxy configuration in application level settings of a Python app. I think the people who would be concerned about this use system wide VPNs or seed boxes.

bartvk 4y ago
SOCKS is sometimes used as an additional layer to privacy. Stock system level VPN will continue without VPN if the VPN server somehow drops the connection.
- dvzk 4y ago
  If you are limiting the discussion to included stock VPN implementations, doesn’t that basically just include IPsec? Most secure third-party options will drop packets that aren’t destined for an encrypted tunnel, even while not running.
  - bartvk 4y ago
    It's been a long time since I used Deluge and found that bug, but I think you're correct. Nowadays I follow your advice and use a third-party option.
em-bee 4y ago
a system wide vpn doesn't always work. in some countries there are apps/websites that only work if they are accessed locally because they block access from outside.

EdwardDiego 4y ago

Welp, it's open source, you've had 10 years to contribute a fix. If you're going to downvote my comment, please explain in a subsequent comment why it's unreasonable to expect that if this is such an egregious bug, someone would've contributed a fix for it? Or at least, a reproducible test case? Given they haven't, it's either not that egregious, or the people complaining are people who feel entitled to take without giving. Which, tbh, probably describes a majority of users of torrent software.

em-bee 4y ago
it looks like people are misreading your comment. at least i did, at first. i thought you were piling on, addressing the maintainer, but on closer reading i realized that you were addressing the parent poster. for what it's worth, i think you are absolutely right.
- EdwardDiego 4y ago
  Well cheers, makes me think you contribute to FOSS too :)
  - em-bee 4y ago
    any opportunity i get. which is sadly not often enough these days.

andrewmackrodt 4y ago

I've been running deluge in Linux since 2019 (version 2.0+, so considerably newer than the bug report) and it appeared to have been using my SOCKS5 proxy settings correctly; I had applied some extra hardening such as disabling natpmp etc, although I'm not sure if those are required. However I don't doubt that these kind of leaks could have happened depending on configuration / bugs etc. Eventually I ended up changing my configuration to run deluge in a VPN container (docker) network namespace so that I could use VPN port forwarding for better speeds (supported by Mullvad).

dvzk 4y ago

It should be removed as an option, but in-application proxy leaks are also common. Application developers are typically not security experts, and built-in proxy implementations are frequently ancient or poorly implemented. Anyone very worried about privacy should be encouraged to use an audited modern alternative that tunnels all traffic from an interface or VM.