11 ms·

StarDict sends X11 clipboard to remote servers

480 points by pabs3 1y ago

bmacho 1y ago
Am I the only one that gets incredibly angry when I read things like this? This is unacceptable on every level.
- pcdoodle 1y ago
  You're not alone. He/She needs a pi in the face bill gates style.
amiga386 1y ago
This article smacks of paternalism. Part of the fun of free software is that it might do terrible things. Debian is not a distro that promises you a walled garden run by an iron-fisted tyrant who beats programmers into submission so they'll respect your privacy Nothing in Debian will install StarDict invisibly. Only you install StarDict. Only you run StarDict. Wayland is not a panacea. If you want StarDict to translate everything you highlight/clip, you will tell Wayland to let StarDict do that. If Wayland can't do that, it's bad, paternalistic software. There is Android and iOS for idiots who want to be bossed around by their device and have no real freedom. The real problem are these HTTP lookups by default, which is the fault of the packager, and Debian as a whole for not prodding them into fixing it. This bug was already reported and fixed as CVE-2009-2260. Then StarDict was kicked out of Debian, and when it came back, so did this bug. The most recent re-reporting of this bug (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 raised in 2015) was fixed a few days ago by removing the dict.cn plugin, 2 days after Vincent Lefevre raised this issue on oss-security-list. He also raised CVE-2025-55014 for another dictionary plugin that sends HTTP requests, which has also been fixed by removing that plugin. Both plugins should be removed from Trixie as of today, and more appropriately, all the "network dictionaries" are now in their own package (stardict-plugin-network-dictionary), not installed by default (stardict-plugin suggests rather than recommends it): Changelog: https://salsa.debian.org/debian/stardict/-/blob/debian/trixie/debian/changelog https://salsa.debian.org/debian/stardict/-/blob/debian/trixi... stardict (3.0.7+git20220909+dfsg-8) unstable; urgency=medium * remove stardict_youdaodict.so plugin from stardict-plugin package, Closes: #1110370 * split network-dictionary plugin to a new binary package stardict-plugin-network-dictionary * add d/NEWS.Debian -- xiao sheng wen <atzlinux@sina.com> Mon, 11 Aug 2025 10:46:11 +0800 stardict (3.0.7+git20220909+dfsg-7) unstable; urgency=medium * d/stardict-plugin.install:not install stardict_dictdotcn.so, Closes: #806960 * d/rules:Added --disable-dictdotcn option, dictdotcn is not provid server now -- xiao sheng wen <atzlinux@sina.com> Wed, 06 Aug 2025 14:09:39 +0800 Control: https://salsa.debian.org/debian/stardict/-/blob/debian/trixie/debian/control https://salsa.debian.org/debian/stardict/-/blob/debian/trixi... Package: stardict-plugin-network-dictionary Description: [...] *Warning* * The query word will send through the network use plain-text in this plugin! * Please do *NOT* selects any confidential data to query dictionary * When enable "Scan" function on stardict, the selected text will sended on the net at once. Package: stardict-plugin Suggests: [...] stardict-plugin-network-dictionary (= ${binary:Version}),
- anonymars 1y ago
  > Part of the fun of free software is that it might do terrible things Yeah you lost me here
  - amiga386 1y ago
    Freedom is the freedom to say rm -rf /* and accept the consequences. If you want to give someone else control over what you can and can't do with your machine, iOS is over there -->
    - anonymars 1y ago
      False dichotomy. Why should I expect that merely installing a dictionary will silently opt me in to sending everything in my clipboard to some third party? You don't need some strawman tyrant to want it to require a user opt-in if that's what you really want to do
      - amiga386 1y ago
        You can expect that any software might do anything, either because of a bug or because it's intentional, and you won't know until you see it happen. It's why the major FOSS licenses say things like THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. You can want software to be well behaved, and in most cases it is. But if you want some level of assurance that the software is behaved as you'd like it, some requirement in law that the software is not allowed to exist unless it meets your requirements, or the platform it runs on is neutered so it literally can't do the thing you don't want it to do -- that's where the tyrant comes in.
        anonymars 1y ago
        Again, false dichotomy. If Debian's maintainers don't put things in the package manager with dodgy behavior, that's not a walled garden like iOS Not having to check your cereal for razor blades is also a freedom
pabs3 1y ago
There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues Luckily there are things like opensnitch that can block some of these issues: https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- fsflover 1y ago
  Are you saying it's an ordinary behavior? There's nothing coming close in your links, especially in Debian.
- account42 1y ago
  Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet. The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".
  - GrayShade 1y ago
    Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?
    - account42 1y ago
      Is this supposed to be some kind of gotcha argument? Against what?
      - GrayShade 1y ago
        Not exactly the same thing, but see https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security_and_privacy_features https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security....
  - amiga386 1y ago
userbinator 1y ago
[flagged]
- therein 1y ago
  I have seen people paste their seed phrase into the URL bar in Chrome, which will send it to Google for auto-complete. Even the access log itself is going to contain compromising information in that case, since that is sent a part of the query string.
- 01HNNWZ0MV43FF 1y ago
  > a password is worth something only to those who know what the password is for I also copy-paste my username from KeePass, so you'd pretty quickly get everything
  - userbinator 1y ago
    [flagged]
    - TheDong 1y ago
      > It's like coming across a key someone dropped on the road. You don't even know what it's for. There's a lot of keys that are self-identifying, even real keys. My key has "Apartment Name, Apartment Number" engraved into the head, and searching the apartment name on google brings it up in the first 5 results. Let's say you find the following plaintext on the network: "sk-xxx....". Do you know what it's for? What if it's AKIAIOSFODNN7EXAMPLE? What if it's a list of words from the BIP-39 wordlist? > Of course all this assumes that there's even someone paying any special attention to the probably huge volume of data that these services are going to get. It only takes one person, and since this is HTTP traffic, not HTTPS, the number of people who can see it is huge. Everyone on your wifi (i.e. the whole coffeeshop, remember firesheep), your ISP, each router between your ISP and china, and so on. I wouldn't be surprised if someone is scanning all traffic that they see for bitcoin private keys and BIP-39 phrases since both of those could lead to some significant financial gain. Heck, back in the day in my college dorm I ran a wifi hotspot only to sniff plaintext traffic and poke around, since I had a less strong sense of morals, and I bet the kids these days are still doing that.
CGamesPlay 1y ago
It's really difficult to not assume malice with something like this. From the maintainer: > The stardict has "Scan" function, when user enable this function, after user select some text, it will trigger stardict do translate for this selected text... Why the user selects some confidential data to query dictionary?
- netsharc 1y ago
  Would be funny if they couldn't tell that the text in a foreign language is confidential... maybe it's stamped "秘密". "Sir, we have intel, the enemy is having translation server errors."
porridgeraisin 1y ago
The easiest solution seems to be to patch it to use offline dictionaries. merriamwebster.txt is 24MB, not a big deal. stardict --install en_US hi_IN ta_IN For a trilingual person, just 100MB of storage. Problem solved no? Edit: it's a full dictionary with all sorts of information. Example entry: ABANDONED A*ban"doned, a. 1. Forsaken, deserted. "Your abandoned streams." Thomson. 2. Self-abandoned, or given up to vice; extremely wicked, or sinning without restraint; irreclaimably wicked ; as, an abandoned villain. Syn. -- Profligate; dissolute; corrupt; vicious; depraved; reprobate; wicked; unprincipled; graceless; vile. -- Abandoned, Profligate, Reprobate. These adjectives agree in expressing the idea of great personal depravity. Profligate has reference to open and shameless immoralities, either in private life or political conduct; as, a profligate court, a profligate ministry. Abandoned is stronger, and has reference to the searing of conscience and hardening of heart produced by a man's giving himself wholly up to iniquity; as, a man of abandoned character. Reprobate describes the condition of one who has become insensible to reproof, and who is morally abandoned and lost beyond hope of recovery. God gave them over to a reprobate mind. Rom. i. 28.
Elucalidavah 1y ago
Querying a local dictionary on each clipboard seems okay; having a feature to request remote dictionaries is okay; making it easy to combine both is dubious but understandable (would be better off as a special flag); but having them combined by default? That's pretty much malicious.
- CorrectHorseBat 1y ago
  [flagged]
  - jeroenhd 1y ago
    There definitely seems to be a cultural difference when it comes to privacy expectations from Chinese companies and western companies. Doesn't mean it's okay to do this kind of thing in a Debian package, of course, but I can understand how this could've happened.
  - dd_xplore 1y ago
    It's malicious intent! The developer isn't a kid, they're releasing the software for world wide use. It's a simple thing, do not send private data to remote servers without explicitly asking the user!
    - CorrectHorseBat 1y ago
      In your eyes maybe (and mine for the record), but different people have different values and expectations of what is privacy.
      - account42 1y ago
        If that was an acceptable response we shouldn't accept people from those cultures into positions where they can affect our privacy. Or we can just stop using "cultural differences" as a bludgeon to whitewash bad behavior.
      - lupusreal 1y ago
charcircuit 1y ago
Meanwhile on Android: - The clipboard can not be read by backgrounded applications - Apps by default are unable to use HTTP
- cdmckay 1y ago
  Meanwhile on Wayland: > StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default.
  - fc417fc802 1y ago
    Seems irrelevant to me. I shouldn't need to defend against software provided by the official repositories. The entire point is for those to be trustworthy. Also Wayland breaks a lot of stuff. It's certainly a move in the right direction on the whole but I wouldn't blindly interpret something like this as a win.
  - porridgeraisin 1y ago
    You are cherry picking. The next statement says that the scan feature doesn't even work on wayland. Lol. That's worse than working + buggy. (security bugs are just bugs. Nothing special about them) > That does mean that it breaks StarDict's scan feature, though.
    - badgersnake 1y ago
      No, Wayland is clearly better here. Not allowing an app to do a potentially stupid privacy compromising thing is better that allowing it by default and providing no way to block it. Better does not necessarily mean good though, that Mac approach of block by default but allow users to enable these things for specific apps on settings would be a great improvement.
      - porridgeraisin 1y ago
        The privacy compromising part is _not_ in the 'reading selection' part. It is in the part where it sends it over http to dict.cn. The solution is therefore, obviously, to replace dict.cn with an offline dictionary. Not what wayland does, which is blocking reading selections in the first place. That is brain damaged. In the X11 case, I can uninstall the app and install one that uses an offline dictionary and gives me a scan feature. That very much is a way to "block" it. Wanting a scan feature is not wrong. It's my computer. I want it. In the Wayland case, I cannot do _anything_ about it. The X11 situation is thus obviously better. It's not like "define current selection" is some niche feature either. It's a default feature in macOs, iOS and Android. You either do it the macos way or the windows/x11 way. You cannot half-ass something in between. That is just security theatre and is utterly retarded. Every wayland release until it makes a macos-style permission system (I dont care whether the default is accept or deny) is pure cancer. And every distro/DE that pushes wayland onto you until that point is also cancer. </rant>
hulitu 1y ago
[flagged]
- qwertox 1y ago
  When you copy a password from a text editor, or some text from a webpage, does Chrome or Firefox send this to their servers? Not even /s makes sense here.
CamouflagedKiwi 1y ago
> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like a trap.
- yjftsjthsd-h 1y ago
  Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
  - markasoftware 1y ago
    a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-knowledge or homomorphic cryptography though!
    - shakna 1y ago
      You should be able to do a K-means type thing. Where your query is an entire group, and you grab the field from the chunk locally. But you might still be able to use some frequency sampling to predict the words used, unless those chunks are very very carefully constructed.
    - account42 1y ago
      > I bet there's some cool way to do this with zero-knowledge or homomorphic cryptography though! The code for which would almost certainly be larger than a fully local dictionary for any human language.
    - bmacho 1y ago
themafia 1y ago
> Part of the justification for moving to Wayland over X11 is to make security vulnerabilities relating to one application spying on another more difficult to introduce. Yea, because, how else am I going to run shady poorly maintained dictionary software that ignores system settings from a hostile country? What kind of world are we living in with X11?! The software could just as well hook into your downloads folder and transparently "translate" any downloaded text or PDF file for you. In which case the method by which pixels arrive on your screen would not be relevant. How is this an X11 vs Wayland issue and not a distribution hygiene issue? Why is this package even a part of the distribution? In the desire to force one desktop system to stop existing, for whatever reason, I think they've missed the broader point.
- guappa 1y ago
  You basically need to call a vote or ask the tech committee to rule otherwise if the maintainer says it's fine. It's not really a bug if it's an advertised feature you don't like, so security team cannot do much in theory.
  - account42 1y ago
    That's a bad policy then.
    - guappa 1y ago
      Write a new one and post it on debian-vote and see if it gets approved :)
- akimbostrawman 1y ago
  >The software could just as well hook into your downloads folder correct which is why wayland is only one piece in improving security, you still need proper sandboxing
  - lupusreal 1y ago
    By the time you have something that allows you to safety run malware you have a usability nightmare.
avhception 1y ago
While I have a lot of respect for the effort that goes into Debian, I always disliked this kind of "maximalism" from the package manager. Oh, the user wants "foo"? Let's install every software that might be even remotely useful somehow in combination with foo! Oh there is a network daemon in there? Fantastic, let's start it immediately! I know that there is a flag to disable the installation for "recommended" packages. I just think the default is a disservice here.
- rfoo 1y ago
  For me it's my most used super long command line flag. For a brief moment `--break-system-packages` surpassed it, then I discovered `pip` accepts abbrev flags so `--br` is enough, and sounds like bruh.
  - IshKebab 1y ago
    > --break-system-packages You can avoid that clusterfuck using `uv tool install`. E.g. `uv tool install pre-commit`.
    - zahlman 1y ago
      It's also not hard to just manage a damn virtual environment yourself.
      - IshKebab 1y ago
        That doesn't really work for tools that you want to be available everywhere.
- bayindirh 1y ago
  I'll politely disagree. First of all, "Recommends" is reserved for packages which enhance the functionality of the package you're installing. Without these the package will not break, but some very useful functionality might be disabled. The package-class you're talking about is "suggests", IOW, "these packages might also be useful for you, wanna look?" section. These are not installed by default already. On the other hand, apt and aptitude provides previews before doing something. You don't have to accept them. In aptitude's case, you can fine tune before the final commit, even. There's a tension. Minimalism vs. user utility. Somebody told in Debian 13 release comments that "Debian will never be a end-user friendly distro". Now, you're saying that packages shouldn't install recommends by default. What should Debian be? "An IKEAesque DIY distro", or "A more user friendly, yet very stable and vanilla distro". I vote for the latter, personally. Plus, as I told before, advanced users are free to use what they want to change. If you want to change the default, the configuration files are at /etc/apt/conf.d/. If you want to disable feature for once, it's --no-install-recommends.
sugarpimpdorsey 1y ago
> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them.
- jacquesm 1y ago
  Such responses to me are proof of malicious intent.
  - avhception 1y ago
    While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
    - account42 1y ago
      We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs. Intent or not, that developer is a risk to the project.
      - vpribish 1y ago
        Finally, a rational argument from the torch and pitchfork crowd. Xiao is not taking security sensitivities to heart : HTTP?? To China‽ and a dismissive BS answer.
    - jacquesm 1y ago
      We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data. Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't even know what you've lost.
qwertox 1y ago
"If user don't like one of these plugin, he can disable it by himself." f.u.
est 1y ago
it looks like a serious "privacy violation" for English-only users. But for many ESL or non-English users out there, the "translation" is a must. On Windoes, I remember some translation programs go extreme, they hijack all GDI calls and scan for all strings on GUIs trying to translate and replace them inline. Local dictionary were pretty limited so many of them use online services. What happens when user input something "sensitive" on the GUI? Well they goes straight to the translation service.
- jeroenhd 1y ago
  Translation isn't the problem, sending data over the network by default is. Data is leaked to Chinese dictionary servers even if you're translating between European languages using a local language according to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960. With the GDI hijacking programs you usually download them for specific languages with the knowledge they're internet connected.
  - est 1y ago
    > Data is leaked to Chinese dictionary servers stardict is a Chinese software and the bug you listed says it "leaks" data to stardict.cn which is one of its official website. https://stardict-4.sourceforge.net/index_en.php https://stardict-4.sourceforge.net/index_en.php Btw looks like the stardict.cn is dead today > with the knowledge they're internet connected Yeah that's pretty much the whole argument. I do agree that programs should not send data in an arbitrary way. Clear text over public network is not OK
- account42 1y ago
  > But for many ESL or non-English users out there, the "translation" is a must. As an ESL user, I vehemently disagree. You're only going to need translations as long as you keep relying on translations. Like it or not but English is the lingua franca of the computing age and you're doing yourself a disservice if you don't learn it.
  - est 1y ago
sugarpimpdorsey 1y ago
How would you like to be the guy that reported this 10 years ago and had the bug closed on some technicality: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 Given enough eyeballs, all bugs are closed as WONTFIX.
- account42 1y ago
  It's not a technicality, the package was removed from Debian so there was no reason to keep the bug report open. And it was reopened by a debian developer when the package was reintroduced a year later. That's not an excuse for why it wasn't dealt with until now but what you are suggesting didn't happen.
  - deleted 1y ago
    [deleted]
qwertox 1y ago
> StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default. StarDict on Wayland has a different issue, it causes a segfault. Sat, 02 Aug 2025: Bug#1003710: stardict crash in gnome with message Segmentation fault https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg2048211.html https://www.mail-archive.com/debian-bugs-dist@lists.debian.o...
- account42 1y ago
  Besides, capturing text from other applications is very much required for various utilities. It's as much of a security feature in Wayland as turning off your computer and never turning it back on is.
  - WhyNotHugo 1y ago
    There is a separate, privileged, interface that this kind of utility can use. Meanwhile, the other 99% of applications don't need unlimited permissions.
    - aragilar 1y ago
      But then StarDict would still be sending your selections out. Personally I think the X11/Wayland distinction is moot, given this appears to be an explicit feature of StarDict, and it seems more likely it just hasn't been ported to Wayland yet.
    - account42 1y ago
      Those privileged interfaces cover known use cases but don't allow for novel tools - or even full functionality of existing tools in many cases. You also underestimate how many programs make use of functionality that could be abused in some way. And unless you lock all those interfaces down it's all security theater. Who cares if the display protocol disallows copy paste snooping when there are a million different ways to get the the memory of other processes or the files that they store sensitive information in. And such a locked down ecosystem is antithetical to free and open computing. I don't use my computer to be secure, I use it to get shit done and and to have fun. I'm not going to accept approaches to security that interfere with that any more than I will accept the same in real life. There aren't any bars over my windows because we have functioning police to deter criminals. I don't need lab tests done for all the food I buy because we have regulations that ensure food sold is generally safe to eat. I go outside without body armor and weapons even though someone could theoretically kill me. 100% security is always a tradeoff for quality of life.
cik 1y ago
My personal security tolerance means that I have multiple levels of firewalls and blockers: network, dns, device, and browser. It's also why I find myself scanning my DNS traffic (pihole), and running OpenSnitch. Whether malicious or not, to me isn't the point. The point is that I, as an individual deserve the illusion of control over my data and communication. I have neither the time, nor inclination to read all release notes. Furthermore, as someone who has spent enough time writing code - I recognize that humans make mistakes and don't always update them with salient details. All the automation in the world, and AI (yes, I've tried AI for release notes) just doesn't help.
hiAndrewQuinn 1y ago
>This would normally not be much cause for concern; of course a dictionary program will include code to talk to dictionary-providing web sites. Hey, an area I finally know something about. It depends on what you're trying to do. The slimmed down version of a Finnish dictionary I provide in `tsk` [1] weighs in at around 30 MB, for about 250,000 Finnish words. It's small enough that I embed the whole dictionary directly into the binary and reconstruct the prefix search on the fly every time the user starts the app. However, the much larger database which contains things like lemmatization and etymology information easily balloons up to many, many gigabytes in size. My problem domain is providing Truly Instant Lookup, keystroke by keystroke, so I can't really get around this level of memoization. The work to figure all this out was sufficient that I decided to make future versions a paid product instead [2]. Most other use cases would just call out to a server, because it's silly to think most people are going to download a giant database for that use case alone. A hybrid approach could also make a lot of sense, eg cache the most common 10,000 words locally and call out for the next 1.5 million, which are statistically extremely rare. [1]: https://github.com/hiandrewquinn/tsk https://github.com/hiandrewquinn/tsk [2]: https://taskusanakirja.com/ https://taskusanakirja.com/ (offline for now until I get Digicert to certify my downloads wholesome for Windows resale)
blackhaz 1y ago
If I would be deciding, I would kick-ban StarDict immediately from the distribution, and scrutinize i) the maintainer for all the packages he has ever touched, ii) StarDict authors for allowing such a default behavior in their system.
Inityx 1y ago
> But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. What year is it?
- jeltz 1y ago
  I assume it must be 2015 at most because my first job in 2008 ran everything, including images, on HTTPS. But I can imagine some last holdpouts 7 years after that.
sbinnee 1y ago
This post caught my eyes immediately because I have been sort of benefiting from StarDict project. Although I do not use it directly. I have been using sdcv, a CLI tool that reads StarDict dictionary. It’s minimal and serves me well.
DonHopkins 1y ago
[flagged]
- angled 1y ago
  A great comment, but your brief mention of fetchmail brought back a flood of memories of .fetchmailrc’s and watching dots on screen as I downloaded my mail from POP3 servers over all sorts of horrible baud rate modems, before I sensibly switched to sending and retrieving my email via UUCP.
- zahlman 1y ago
  [flagged]
  - DonHopkins 1y ago
    [flagged]
    - zahlman 1y ago
      I'm not making any such point. I am, however, pointing out that your posts here clearly have much more to do with your personal grudges than with the many-eyes principle itself. But also, how racist ESR is or isn't is completely and utterly irrelevant to how security works in FOSS.
paffdragon 1y ago
Somewhat related, I was quite surprised when I discovered that my Samsung phone was sharing ALL my clipboard with all my other Samsung devices, including passwords copied into the clipboard, and even preserving the history. I can't remember if the sharing was enabled by default or I opted in by accident. I assume it also goes through their servers to reach my other devices. I could disable the sharing, but still can't turn off the clipboard history, even switching to a different keyboard, the Samsung keyboard still captures the clipboard and saves the history, when I switch the keyboard to Samsung everything is there... I guess my next phone won't be Samsung.
- nullify88 1y ago
  I usually suggest not to create or login with a Samsung Account on Samsung devices. It's just another opportunity for a company to get at your data.
- dannyw 1y ago
  Yes, and we know at least Samsung TVs sell your details and what you watch to marketers and everyone. Samsung’s privacy policy is the same for phones and TVs.
- xpressvideoz 1y ago
  [flagged]
  - paffdragon 1y ago
    > You're just an impatient paranoid, easily jumping to conclusions. You should be ashamed for spreading false information. Thank you for your kind words, please look at the HN comment guidelines when you have a chance. Your point would have been an excellent correction if shared thoughtfully, but it's all negated by the name calling and personal attacks.
    - olejorgenb 1y ago
      IIRC, the GP claimed clipboard sharing between Samsung devices only happens over the local network
eadmund 1y ago
The Wayland framing at the end strikes me as misleading. This gets it exactly right: > Or maybe StarDict would have started asking for special permissions to let it work on Wayland, and users would have accepted those defaults the same way they currently do. Yes, that’s what it would do. Its installer might even configure that special permission automatically, without user intervention. Malware’s gonna mal. Wayland might help defend against some things, but it’s not going to defend against packages installed as part of the distro.
- heresie-dabord 1y ago
  It is not misleading, Wayland is better than Xorg in this particular respect. But the other concern is part of the systemic problem. Consider that the data that was transmitted was sent in the clear! > StarDict ... while running on X11, using Debian's default configuration, it will send a user's text selections over unencrypted HTTP to two remote servers. > Any user who did read the description of the package, and who knew what the YouDao plugin would do, might nevertheless expect the resulting communication to at least be encrypted. But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. So, not only are these servers sent any text the user selects, but anyone who can view traffic anywhere along its path can see the same thing.
- kelnos 1y ago
  It's extra misleading, because "Wayland" isn't a thing when it comes to policy like this. Unless a compositor implements some sort of user approve/deny UI when an app requests access to the clipboard, apps on Wayland can snoop on the clipboard just as easily as on X11. I haven't run GNOME or KDE in Wayland mode, so maybe they do implement something like that, but none of the wlroots-based compositors I've tried do.
londons_explore 1y ago
> According to Debian's package popularity contest statistics, only 178 people have StarDict installed A problem for those 178 people... But on a global scale this isn't really a concern.
- frumiousirc 1y ago
  Not everyone participates in the popularity context. By some estimates about 1% of users do: There are about a quarter million popcon responses in Debian's recent popcon graphs. Absolute number of users is hard to estimate but I find one estimate of 20-50 million Debian users. So taking 1% as a lower bound, at least 18k people use StarDict in Debian. I don't know how to guess the number that use StarDict in another OS.
M95D 1y ago
In my Windows, it wouldn't be a problem. The firewall I use would pop up for any new program that tries to connect somewhere. But Linux doesn't have a per-program firewall. ... and even if it did, there's no way to do popups/questions from the kernel, ... and even if there was, most programs would just run curl or wget or openssl. That would mean a popup for each and every connection attempt through those programs.
- ziml77 1y ago
  Windows does certain security things better than Linux OSes, which makes it such a shame that Microsoft keeps shipping more and more stuff with Windows that undermines all that work.
- const_cast 1y ago
  Opensnitch is really good on Linux
  - M95D 1y ago
    It requires having dbus, it's for the popups, one of the things I said the kernel doesn't have. But unfortunately, IMHO, dbus is a much bigger privacy risk than not having a per-app firewall - it broadcasts everything that happens in the computer to any program that would listen. I hate programs communicating to each other without my consent even more than I hate programs connecting to the internet without my consent.
    - const_cast 1y ago
      Dbus is just for IPC. Its up to the apps and developers to choose how to set up their interfaces. Sensitive interfaces do have auth. Its just COM but better, and allows for some great automation.
st3fan 1y ago
> of course a dictionary program will include code to talk to dictionary-providing web sites. It is funny to read this considering all the rage when say Siri does this.
st3fan 1y ago
Why is nobody talking about how this software sends text to servers in china over an unencrypted connection?
computator 1y ago
Can someone recommend a completely local English-language dictionary for Debian?
- somat 1y ago
  I recently found wordnet through an offline dictionary/thesaurus program and thought it was a pretty neat project. https://wordnet.princeton.edu/ https://wordnet.princeton.edu/ For my use case I was more interested in the data than the application and so never installed it and am unable to comment on how usable it is, but will include a link if you want to look. https://sourceforge.net/projects/artha/ https://sourceforge.net/projects/artha/
deleted 1y ago
[deleted]
jeffWrld 1y ago
[dead]
johnklos 1y ago
Their reaction reminds me of when the Raspberry Pi Foundation tried gaslighting us. RPi Foundation hires a cop and brags about how cop used RPis to spy on people. People got upset. RPi Foundation acts clueless and says vegetarians and vegans were upset because they posted a picture of meat. Now Debian is less concerned with their core tenets and more concerned with winning popularity contests, as can be evidenced by their dropping of i386 support, for instance. Instead of seeing an issue like this and raising an alarm, examining how this possibly happened, and discussing ways of making sure it doesn't happen again, they're like, "eh, so what?" Debian, which for ages was the last big holdout of Linuxes becoming corporate, seems to have a bleak future.
hoppp 1y ago
Its a key stealing malware? Damn good I dont use it
pbohun 1y ago
I don't understand why the whole thing isn't local. A comprehensive Chinese dictionary has less than 400k words. Even at 1k per word that's less than 400MB. It's just poor design to make something require a network connection when it could work offline locally.
- slanterns 1y ago
  Then we should have a copy-left dictionary first.
737min 1y ago
Should some open source contributors & maintainers be considered an APT group and tracked thecsame way?
sneak 1y ago
Apple did something similar in 2015: CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html https://lists.apple.com/archives/security-announce/2015/Aug/... You had to three-finger press to trigger it, though. Similarly, it used unencrypted HTTP. I reported it and it was fixed to use TLS. The dev defending this unencrypted behavior is really wild, though.
- koito17 1y ago
  Most Chinese sites do not use HTTPS. In fact, TLS 1.3 traffic seems to be completely blocked within China's internet.[1] The decision to use plain HTTP is only strange from a Western viewpoint. Note: I am not defending this behavior. I still remember the era of ISPs injecting content into webpages. But it's important to keep in mind our subset of the world does not reflect the rest of the world. [1] https://news.ycombinator.com/item?id=24093932 https://news.ycombinator.com/item?id=24093932
  - sneak 1y ago
    It does reflect the rest of the world; China is the extreme outlier here. Also, accessing GitHub from within mainland China works, so TLS is not completely banned.
utbabya 1y ago
Whatever is making plain HTTP requests in 2025 should be a cause of concern. Wouldn't it be nice to have a low resource daemon watching for common pitfalls alerting users so we eliminate or minimise classes of problems like this? I think lots of windows antivirus come with features like this? Perhaps with vast crystalized kno eledge nowadays we can afford to create OSS system level package that offers some level of protection. I might actually do it, any down side?
kingforaday 1y ago
Anyone else see the old UA string in strace out: User-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98) Also the \r\n in the output is irregular too.
- neverrroot 1y ago
  Signature, a distinctive signature that looks like.
asveikau 1y ago
I honestly don't think x11 is the primary problem. The package maintainer not thinking it's a big deal to send this data over http by default wouldn't be a good situation on Wayland either. They wouldn't get the clipboard but they're still not responsible. I presume this program also has full access to the filesystem.
aakkaakk 1y ago
Docs is obviously designed to be misleading. If I would design a malware, this is how I would do it. Plausible deniability. Don’t fool yourself. Kick this shit, and people who develop it, out of debian asap.
weare138 1y ago
A society that balances cause and effect! Money is also balanced! Money flows perfectly through multiple lifetimes! Being respected ultimately leads to balance! What?
rapiz 1y ago
Some context for ppl who are not paranoid, it's a very old software and not very maintained since very long time ago. I'm pretty sure HTTPS was not common at the time. And the selection scanning a very common and wanted feature in many alternatives for windows, browsers, etc. If there's anything we can learn from it - don't use obsolete software.

480 points by pabs3 1y ago

bmacho 1y ago

Am I the only one that gets incredibly angry when I read things like this? This is unacceptable on every level.

pcdoodle 1y ago
You're not alone. He/She needs a pi in the face bill gates style.

amiga386 1y ago

This article smacks of paternalism. Part of the fun of free software is that it might do terrible things. Debian is not a distro that promises you a walled garden run by an iron-fisted tyrant who beats programmers into submission so they'll respect your privacy Nothing in Debian will install StarDict invisibly. Only you install StarDict. Only you run StarDict. Wayland is not a panacea. If you want StarDict to translate everything you highlight/clip, you will tell Wayland to let StarDict do that. If Wayland can't do that, it's bad, paternalistic software. There is Android and iOS for idiots who want to be bossed around by their device and have no real freedom. The real problem are these HTTP lookups by default, which is the fault of the packager, and Debian as a whole for not prodding them into fixing it. This bug was already reported and fixed as CVE-2009-2260. Then StarDict was kicked out of Debian, and when it came back, so did this bug. The most recent re-reporting of this bug (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 raised in 2015) was fixed a few days ago by removing the dict.cn plugin, 2 days after Vincent Lefevre raised this issue on oss-security-list. He also raised CVE-2025-55014 for another dictionary plugin that sends HTTP requests, which has also been fixed by removing that plugin. Both plugins should be removed from Trixie as of today, and more appropriately, all the "network dictionaries" are now in their own package (stardict-plugin-network-dictionary), not installed by default (stardict-plugin suggests rather than recommends it): Changelog: https://salsa.debian.org/debian/stardict/-/blob/debian/trixie/debian/changelog https://salsa.debian.org/debian/stardict/-/blob/debian/trixi... stardict (3.0.7+git20220909+dfsg-8) unstable; urgency=medium * remove stardict_youdaodict.so plugin from stardict-plugin package, Closes: #1110370 * split network-dictionary plugin to a new binary package stardict-plugin-network-dictionary * add d/NEWS.Debian -- xiao sheng wen <atzlinux@sina.com> Mon, 11 Aug 2025 10:46:11 +0800 stardict (3.0.7+git20220909+dfsg-7) unstable; urgency=medium * d/stardict-plugin.install:not install stardict_dictdotcn.so, Closes: #806960 * d/rules:Added --disable-dictdotcn option, dictdotcn is not provid server now -- xiao sheng wen <atzlinux@sina.com> Wed, 06 Aug 2025 14:09:39 +0800 Control: https://salsa.debian.org/debian/stardict/-/blob/debian/trixie/debian/control https://salsa.debian.org/debian/stardict/-/blob/debian/trixi... Package: stardict-plugin-network-dictionary Description: [...] *Warning* * The query word will send through the network use plain-text in this plugin! * Please do *NOT* selects any confidential data to query dictionary * When enable "Scan" function on stardict, the selected text will sended on the net at once. Package: stardict-plugin Suggests: [...] stardict-plugin-network-dictionary (= ${binary:Version}),

anonymars 1y ago
> Part of the fun of free software is that it might do terrible things Yeah you lost me here
- amiga386 1y ago
  Freedom is the freedom to say rm -rf /* and accept the consequences. If you want to give someone else control over what you can and can't do with your machine, iOS is over there -->
  - anonymars 1y ago
    False dichotomy. Why should I expect that merely installing a dictionary will silently opt me in to sending everything in my clipboard to some third party? You don't need some strawman tyrant to want it to require a user opt-in if that's what you really want to do
    - amiga386 1y ago
      You can expect that any software might do anything, either because of a bug or because it's intentional, and you won't know until you see it happen. It's why the major FOSS licenses say things like THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. You can want software to be well behaved, and in most cases it is. But if you want some level of assurance that the software is behaved as you'd like it, some requirement in law that the software is not allowed to exist unless it meets your requirements, or the platform it runs on is neutered so it literally can't do the thing you don't want it to do -- that's where the tyrant comes in.
      - anonymars 1y ago
        Again, false dichotomy. If Debian's maintainers don't put things in the package manager with dodgy behavior, that's not a walled garden like iOS Not having to check your cereal for razor blades is also a freedom

pabs3 1y ago

There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues Luckily there are things like opensnitch that can block some of these issues: https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch

fsflover 1y ago
Are you saying it's an ordinary behavior? There's nothing coming close in your links, especially in Debian.
account42 1y ago
Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet. The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".
- GrayShade 1y ago
  Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?
  - account42 1y ago
    Is this supposed to be some kind of gotcha argument? Against what?
    - GrayShade 1y ago
      Not exactly the same thing, but see https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security_and_privacy_features https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security....
- amiga386 1y ago

userbinator 1y ago

[flagged]

therein 1y ago
I have seen people paste their seed phrase into the URL bar in Chrome, which will send it to Google for auto-complete. Even the access log itself is going to contain compromising information in that case, since that is sent a part of the query string.
01HNNWZ0MV43FF 1y ago
> a password is worth something only to those who know what the password is for I also copy-paste my username from KeePass, so you'd pretty quickly get everything
- userbinator 1y ago
  [flagged]
  - TheDong 1y ago
    > It's like coming across a key someone dropped on the road. You don't even know what it's for. There's a lot of keys that are self-identifying, even real keys. My key has "Apartment Name, Apartment Number" engraved into the head, and searching the apartment name on google brings it up in the first 5 results. Let's say you find the following plaintext on the network: "sk-xxx....". Do you know what it's for? What if it's AKIAIOSFODNN7EXAMPLE? What if it's a list of words from the BIP-39 wordlist? > Of course all this assumes that there's even someone paying any special attention to the probably huge volume of data that these services are going to get. It only takes one person, and since this is HTTP traffic, not HTTPS, the number of people who can see it is huge. Everyone on your wifi (i.e. the whole coffeeshop, remember firesheep), your ISP, each router between your ISP and china, and so on. I wouldn't be surprised if someone is scanning all traffic that they see for bitcoin private keys and BIP-39 phrases since both of those could lead to some significant financial gain. Heck, back in the day in my college dorm I ran a wifi hotspot only to sniff plaintext traffic and poke around, since I had a less strong sense of morals, and I bet the kids these days are still doing that.

CGamesPlay 1y ago

It's really difficult to not assume malice with something like this. From the maintainer: > The stardict has "Scan" function, when user enable this function, after user select some text, it will trigger stardict do translate for this selected text... Why the user selects some confidential data to query dictionary?

netsharc 1y ago
Would be funny if they couldn't tell that the text in a foreign language is confidential... maybe it's stamped "秘密". "Sir, we have intel, the enemy is having translation server errors."

porridgeraisin 1y ago

The easiest solution seems to be to patch it to use offline dictionaries. merriamwebster.txt is 24MB, not a big deal. stardict --install en_US hi_IN ta_IN For a trilingual person, just 100MB of storage. Problem solved no? Edit: it's a full dictionary with all sorts of information. Example entry: ABANDONED A*ban"doned, a. 1. Forsaken, deserted. "Your abandoned streams." Thomson. 2. Self-abandoned, or given up to vice; extremely wicked, or sinning without restraint; irreclaimably wicked ; as, an abandoned villain. Syn. -- Profligate; dissolute; corrupt; vicious; depraved; reprobate; wicked; unprincipled; graceless; vile. -- Abandoned, Profligate, Reprobate. These adjectives agree in expressing the idea of great personal depravity. Profligate has reference to open and shameless immoralities, either in private life or political conduct; as, a profligate court, a profligate ministry. Abandoned is stronger, and has reference to the searing of conscience and hardening of heart produced by a man's giving himself wholly up to iniquity; as, a man of abandoned character. Reprobate describes the condition of one who has become insensible to reproof, and who is morally abandoned and lost beyond hope of recovery. God gave them over to a reprobate mind. Rom. i. 28.

Elucalidavah 1y ago

Querying a local dictionary on each clipboard seems okay; having a feature to request remote dictionaries is okay; making it easy to combine both is dubious but understandable (would be better off as a special flag); but having them combined by default? That's pretty much malicious.

CorrectHorseBat 1y ago
[flagged]
- jeroenhd 1y ago
  There definitely seems to be a cultural difference when it comes to privacy expectations from Chinese companies and western companies. Doesn't mean it's okay to do this kind of thing in a Debian package, of course, but I can understand how this could've happened.
- dd_xplore 1y ago
  It's malicious intent! The developer isn't a kid, they're releasing the software for world wide use. It's a simple thing, do not send private data to remote servers without explicitly asking the user!
  - CorrectHorseBat 1y ago
    In your eyes maybe (and mine for the record), but different people have different values and expectations of what is privacy.
    - account42 1y ago
      If that was an acceptable response we shouldn't accept people from those cultures into positions where they can affect our privacy. Or we can just stop using "cultural differences" as a bludgeon to whitewash bad behavior.
    - lupusreal 1y ago

charcircuit 1y ago

Meanwhile on Android: - The clipboard can not be read by backgrounded applications - Apps by default are unable to use HTTP

cdmckay 1y ago
Meanwhile on Wayland: > StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default.
- fc417fc802 1y ago
  Seems irrelevant to me. I shouldn't need to defend against software provided by the official repositories. The entire point is for those to be trustworthy. Also Wayland breaks a lot of stuff. It's certainly a move in the right direction on the whole but I wouldn't blindly interpret something like this as a win.
- porridgeraisin 1y ago
  You are cherry picking. The next statement says that the scan feature doesn't even work on wayland. Lol. That's worse than working + buggy. (security bugs are just bugs. Nothing special about them) > That does mean that it breaks StarDict's scan feature, though.
  - badgersnake 1y ago
    No, Wayland is clearly better here. Not allowing an app to do a potentially stupid privacy compromising thing is better that allowing it by default and providing no way to block it. Better does not necessarily mean good though, that Mac approach of block by default but allow users to enable these things for specific apps on settings would be a great improvement.
    - porridgeraisin 1y ago
      The privacy compromising part is _not_ in the 'reading selection' part. It is in the part where it sends it over http to dict.cn. The solution is therefore, obviously, to replace dict.cn with an offline dictionary. Not what wayland does, which is blocking reading selections in the first place. That is brain damaged. In the X11 case, I can uninstall the app and install one that uses an offline dictionary and gives me a scan feature. That very much is a way to "block" it. Wanting a scan feature is not wrong. It's my computer. I want it. In the Wayland case, I cannot do _anything_ about it. The X11 situation is thus obviously better. It's not like "define current selection" is some niche feature either. It's a default feature in macOs, iOS and Android. You either do it the macos way or the windows/x11 way. You cannot half-ass something in between. That is just security theatre and is utterly retarded. Every wayland release until it makes a macos-style permission system (I dont care whether the default is accept or deny) is pure cancer. And every distro/DE that pushes wayland onto you until that point is also cancer. </rant>

hulitu 1y ago

[flagged]

qwertox 1y ago
When you copy a password from a text editor, or some text from a webpage, does Chrome or Firefox send this to their servers? Not even /s makes sense here.

CamouflagedKiwi 1y ago

> of course a dictionary program will include code to talk to dictionary-providing web sites. I wouldn't say that is just a given, if I've apt-get installed a dictionary I might expect that is the whole thing on my machine. It's not like we haven't had dictionaries in physical books for centuries... It seems like stardict is very much an online thing, which I suppose could be legit, but the whole thing does seem like a trap.

yjftsjthsd-h 1y ago
Dumb question... Could you do a per-word bloom filter to do online spell checking without actually disclosing the words you're checking?
- markasoftware 1y ago
  a bloom filter look up is by hash, and given the relatively small set of words in english, it would be pretty easy for the server to reverse the hash sent to it. Thus a bloom filter wouldn't be very private. Additionally, a typical spell checker feature is to provide alternative, correct, spellings, rather than just telling you whether a word is correctly spelled. I bet there's some cool way to do this with zero-knowledge or homomorphic cryptography though!
  - shakna 1y ago
    You should be able to do a K-means type thing. Where your query is an entire group, and you grab the field from the chunk locally. But you might still be able to use some frequency sampling to predict the words used, unless those chunks are very very carefully constructed.
  - account42 1y ago
    > I bet there's some cool way to do this with zero-knowledge or homomorphic cryptography though! The code for which would almost certainly be larger than a fully local dictionary for any human language.
  - bmacho 1y ago

themafia 1y ago

> Part of the justification for moving to Wayland over X11 is to make security vulnerabilities relating to one application spying on another more difficult to introduce. Yea, because, how else am I going to run shady poorly maintained dictionary software that ignores system settings from a hostile country? What kind of world are we living in with X11?! The software could just as well hook into your downloads folder and transparently "translate" any downloaded text or PDF file for you. In which case the method by which pixels arrive on your screen would not be relevant. How is this an X11 vs Wayland issue and not a distribution hygiene issue? Why is this package even a part of the distribution? In the desire to force one desktop system to stop existing, for whatever reason, I think they've missed the broader point.

guappa 1y ago
You basically need to call a vote or ask the tech committee to rule otherwise if the maintainer says it's fine. It's not really a bug if it's an advertised feature you don't like, so security team cannot do much in theory.
- account42 1y ago
  That's a bad policy then.
  - guappa 1y ago
    Write a new one and post it on debian-vote and see if it gets approved :)
akimbostrawman 1y ago
>The software could just as well hook into your downloads folder correct which is why wayland is only one piece in improving security, you still need proper sandboxing
- lupusreal 1y ago
  By the time you have something that allows you to safety run malware you have a usability nightmare.

avhception 1y ago

While I have a lot of respect for the effort that goes into Debian, I always disliked this kind of "maximalism" from the package manager. Oh, the user wants "foo"? Let's install every software that might be even remotely useful somehow in combination with foo! Oh there is a network daemon in there? Fantastic, let's start it immediately! I know that there is a flag to disable the installation for "recommended" packages. I just think the default is a disservice here.

rfoo 1y ago
For me it's my most used super long command line flag. For a brief moment `--break-system-packages` surpassed it, then I discovered `pip` accepts abbrev flags so `--br` is enough, and sounds like bruh.
- IshKebab 1y ago
  > --break-system-packages You can avoid that clusterfuck using `uv tool install`. E.g. `uv tool install pre-commit`.
  - zahlman 1y ago
    It's also not hard to just manage a damn virtual environment yourself.
    - IshKebab 1y ago
      That doesn't really work for tools that you want to be available everywhere.
bayindirh 1y ago
I'll politely disagree. First of all, "Recommends" is reserved for packages which enhance the functionality of the package you're installing. Without these the package will not break, but some very useful functionality might be disabled. The package-class you're talking about is "suggests", IOW, "these packages might also be useful for you, wanna look?" section. These are not installed by default already. On the other hand, apt and aptitude provides previews before doing something. You don't have to accept them. In aptitude's case, you can fine tune before the final commit, even. There's a tension. Minimalism vs. user utility. Somebody told in Debian 13 release comments that "Debian will never be a end-user friendly distro". Now, you're saying that packages shouldn't install recommends by default. What should Debian be? "An IKEAesque DIY distro", or "A more user friendly, yet very stable and vanilla distro". I vote for the latter, personally. Plus, as I told before, advanced users are free to use what they want to change. If you want to change the default, the configuration files are at /etc/apt/conf.d/. If you want to disable feature for once, it's --no-install-recommends.

sugarpimpdorsey 1y ago

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them.

jacquesm 1y ago
Such responses to me are proof of malicious intent.
- avhception 1y ago
  While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
  - account42 1y ago
    We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs. Intent or not, that developer is a risk to the project.
    - vpribish 1y ago
      Finally, a rational argument from the torch and pitchfork crowd. Xiao is not taking security sensitivities to heart : HTTP?? To China‽ and a dismissive BS answer.
  - jacquesm 1y ago
    We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data. Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't even know what you've lost.

qwertox 1y ago

"If user don't like one of these plugin, he can disable it by himself." f.u.

est 1y ago

it looks like a serious "privacy violation" for English-only users. But for many ESL or non-English users out there, the "translation" is a must. On Windoes, I remember some translation programs go extreme, they hijack all GDI calls and scan for all strings on GUIs trying to translate and replace them inline. Local dictionary were pretty limited so many of them use online services. What happens when user input something "sensitive" on the GUI? Well they goes straight to the translation service.

jeroenhd 1y ago
Translation isn't the problem, sending data over the network by default is. Data is leaked to Chinese dictionary servers even if you're translating between European languages using a local language according to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960. With the GDI hijacking programs you usually download them for specific languages with the knowledge they're internet connected.
- est 1y ago
  > Data is leaked to Chinese dictionary servers stardict is a Chinese software and the bug you listed says it "leaks" data to stardict.cn which is one of its official website. https://stardict-4.sourceforge.net/index_en.php https://stardict-4.sourceforge.net/index_en.php Btw looks like the stardict.cn is dead today > with the knowledge they're internet connected Yeah that's pretty much the whole argument. I do agree that programs should not send data in an arbitrary way. Clear text over public network is not OK
account42 1y ago
> But for many ESL or non-English users out there, the "translation" is a must. As an ESL user, I vehemently disagree. You're only going to need translations as long as you keep relying on translations. Like it or not but English is the lingua franca of the computing age and you're doing yourself a disservice if you don't learn it.
- est 1y ago

sugarpimpdorsey 1y ago

How would you like to be the guy that reported this 10 years ago and had the bug closed on some technicality: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806960 Given enough eyeballs, all bugs are closed as WONTFIX.

account42 1y ago
It's not a technicality, the package was removed from Debian so there was no reason to keep the bug report open. And it was reopened by a debian developer when the package was reintroduced a year later. That's not an excuse for why it wasn't dealt with until now but what you are suggesting didn't happen.
- deleted 1y ago
  [deleted]

qwertox 1y ago

> StarDict on Wayland doesn't have this problem, because Wayland prevents applications from being able to capture text from other applications by default. StarDict on Wayland has a different issue, it causes a segfault. Sat, 02 Aug 2025: Bug#1003710: stardict crash in gnome with message Segmentation fault https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg2048211.html https://www.mail-archive.com/debian-bugs-dist@lists.debian.o...

account42 1y ago
Besides, capturing text from other applications is very much required for various utilities. It's as much of a security feature in Wayland as turning off your computer and never turning it back on is.
- WhyNotHugo 1y ago
  There is a separate, privileged, interface that this kind of utility can use. Meanwhile, the other 99% of applications don't need unlimited permissions.
  - aragilar 1y ago
    But then StarDict would still be sending your selections out. Personally I think the X11/Wayland distinction is moot, given this appears to be an explicit feature of StarDict, and it seems more likely it just hasn't been ported to Wayland yet.
  - account42 1y ago
    Those privileged interfaces cover known use cases but don't allow for novel tools - or even full functionality of existing tools in many cases. You also underestimate how many programs make use of functionality that could be abused in some way. And unless you lock all those interfaces down it's all security theater. Who cares if the display protocol disallows copy paste snooping when there are a million different ways to get the the memory of other processes or the files that they store sensitive information in. And such a locked down ecosystem is antithetical to free and open computing. I don't use my computer to be secure, I use it to get shit done and and to have fun. I'm not going to accept approaches to security that interfere with that any more than I will accept the same in real life. There aren't any bars over my windows because we have functioning police to deter criminals. I don't need lab tests done for all the food I buy because we have regulations that ensure food sold is generally safe to eat. I go outside without body armor and weapons even though someone could theoretically kill me. 100% security is always a tradeoff for quality of life.

cik 1y ago

My personal security tolerance means that I have multiple levels of firewalls and blockers: network, dns, device, and browser. It's also why I find myself scanning my DNS traffic (pihole), and running OpenSnitch. Whether malicious or not, to me isn't the point. The point is that I, as an individual deserve the illusion of control over my data and communication. I have neither the time, nor inclination to read all release notes. Furthermore, as someone who has spent enough time writing code - I recognize that humans make mistakes and don't always update them with salient details. All the automation in the world, and AI (yes, I've tried AI for release notes) just doesn't help.

hiAndrewQuinn 1y ago

>This would normally not be much cause for concern; of course a dictionary program will include code to talk to dictionary-providing web sites. Hey, an area I finally know something about. It depends on what you're trying to do. The slimmed down version of a Finnish dictionary I provide in `tsk` [1] weighs in at around 30 MB, for about 250,000 Finnish words. It's small enough that I embed the whole dictionary directly into the binary and reconstruct the prefix search on the fly every time the user starts the app. However, the much larger database which contains things like lemmatization and etymology information easily balloons up to many, many gigabytes in size. My problem domain is providing Truly Instant Lookup, keystroke by keystroke, so I can't really get around this level of memoization. The work to figure all this out was sufficient that I decided to make future versions a paid product instead [2]. Most other use cases would just call out to a server, because it's silly to think most people are going to download a giant database for that use case alone. A hybrid approach could also make a lot of sense, eg cache the most common 10,000 words locally and call out for the next 1.5 million, which are statistically extremely rare. [1]: https://github.com/hiandrewquinn/tsk https://github.com/hiandrewquinn/tsk [2]: https://taskusanakirja.com/ https://taskusanakirja.com/ (offline for now until I get Digicert to certify my downloads wholesome for Windows resale)

blackhaz 1y ago

If I would be deciding, I would kick-ban StarDict immediately from the distribution, and scrutinize i) the maintainer for all the packages he has ever touched, ii) StarDict authors for allowing such a default behavior in their system.

Inityx 1y ago

> But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. What year is it?

jeltz 1y ago
I assume it must be 2015 at most because my first job in 2008 ran everything, including images, on HTTPS. But I can imagine some last holdpouts 7 years after that.

sbinnee 1y ago

This post caught my eyes immediately because I have been sort of benefiting from StarDict project. Although I do not use it directly. I have been using sdcv, a CLI tool that reads StarDict dictionary. It’s minimal and serves me well.

DonHopkins 1y ago

[flagged]

angled 1y ago
A great comment, but your brief mention of fetchmail brought back a flood of memories of .fetchmailrc’s and watching dots on screen as I downloaded my mail from POP3 servers over all sorts of horrible baud rate modems, before I sensibly switched to sending and retrieving my email via UUCP.
zahlman 1y ago
[flagged]
- DonHopkins 1y ago
  [flagged]
  - zahlman 1y ago
    I'm not making any such point. I am, however, pointing out that your posts here clearly have much more to do with your personal grudges than with the many-eyes principle itself. But also, how racist ESR is or isn't is completely and utterly irrelevant to how security works in FOSS.

paffdragon 1y ago

Somewhat related, I was quite surprised when I discovered that my Samsung phone was sharing ALL my clipboard with all my other Samsung devices, including passwords copied into the clipboard, and even preserving the history. I can't remember if the sharing was enabled by default or I opted in by accident. I assume it also goes through their servers to reach my other devices. I could disable the sharing, but still can't turn off the clipboard history, even switching to a different keyboard, the Samsung keyboard still captures the clipboard and saves the history, when I switch the keyboard to Samsung everything is there... I guess my next phone won't be Samsung.

nullify88 1y ago
I usually suggest not to create or login with a Samsung Account on Samsung devices. It's just another opportunity for a company to get at your data.
dannyw 1y ago
Yes, and we know at least Samsung TVs sell your details and what you watch to marketers and everyone. Samsung’s privacy policy is the same for phones and TVs.
xpressvideoz 1y ago
[flagged]
- paffdragon 1y ago
  > You're just an impatient paranoid, easily jumping to conclusions. You should be ashamed for spreading false information. Thank you for your kind words, please look at the HN comment guidelines when you have a chance. Your point would have been an excellent correction if shared thoughtfully, but it's all negated by the name calling and personal attacks.
  - olejorgenb 1y ago
    IIRC, the GP claimed clipboard sharing between Samsung devices only happens over the local network

eadmund 1y ago

The Wayland framing at the end strikes me as misleading. This gets it exactly right: > Or maybe StarDict would have started asking for special permissions to let it work on Wayland, and users would have accepted those defaults the same way they currently do. Yes, that’s what it would do. Its installer might even configure that special permission automatically, without user intervention. Malware’s gonna mal. Wayland might help defend against some things, but it’s not going to defend against packages installed as part of the distro.

heresie-dabord 1y ago
It is not misleading, Wayland is better than Xorg in this particular respect. But the other concern is part of the systemic problem. Consider that the data that was transmitted was sent in the clear! > StarDict ... while running on X11, using Debian's default configuration, it will send a user's text selections over unencrypted HTTP to two remote servers. > Any user who did read the description of the package, and who knew what the YouDao plugin would do, might nevertheless expect the resulting communication to at least be encrypted. But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP. So, not only are these servers sent any text the user selects, but anyone who can view traffic anywhere along its path can see the same thing.
kelnos 1y ago
It's extra misleading, because "Wayland" isn't a thing when it comes to policy like this. Unless a compositor implements some sort of user approve/deny UI when an app requests access to the clipboard, apps on Wayland can snoop on the clipboard just as easily as on X11. I haven't run GNOME or KDE in Wayland mode, so maybe they do implement something like that, but none of the wlroots-based compositors I've tried do.

londons_explore 1y ago

> According to Debian's package popularity contest statistics, only 178 people have StarDict installed A problem for those 178 people... But on a global scale this isn't really a concern.

frumiousirc 1y ago
Not everyone participates in the popularity context. By some estimates about 1% of users do: There are about a quarter million popcon responses in Debian's recent popcon graphs. Absolute number of users is hard to estimate but I find one estimate of 20-50 million Debian users. So taking 1% as a lower bound, at least 18k people use StarDict in Debian. I don't know how to guess the number that use StarDict in another OS.

M95D 1y ago

In my Windows, it wouldn't be a problem. The firewall I use would pop up for any new program that tries to connect somewhere. But Linux doesn't have a per-program firewall. ... and even if it did, there's no way to do popups/questions from the kernel, ... and even if there was, most programs would just run curl or wget or openssl. That would mean a popup for each and every connection attempt through those programs.

ziml77 1y ago
Windows does certain security things better than Linux OSes, which makes it such a shame that Microsoft keeps shipping more and more stuff with Windows that undermines all that work.
const_cast 1y ago
Opensnitch is really good on Linux
- M95D 1y ago
  It requires having dbus, it's for the popups, one of the things I said the kernel doesn't have. But unfortunately, IMHO, dbus is a much bigger privacy risk than not having a per-app firewall - it broadcasts everything that happens in the computer to any program that would listen. I hate programs communicating to each other without my consent even more than I hate programs connecting to the internet without my consent.
  - const_cast 1y ago
    Dbus is just for IPC. Its up to the apps and developers to choose how to set up their interfaces. Sensitive interfaces do have auth. Its just COM but better, and allows for some great automation.

st3fan 1y ago

> of course a dictionary program will include code to talk to dictionary-providing web sites. It is funny to read this considering all the rage when say Siri does this.

st3fan 1y ago

Why is nobody talking about how this software sends text to servers in china over an unencrypted connection?

computator 1y ago

Can someone recommend a completely local English-language dictionary for Debian?

somat 1y ago
I recently found wordnet through an offline dictionary/thesaurus program and thought it was a pretty neat project. https://wordnet.princeton.edu/ https://wordnet.princeton.edu/ For my use case I was more interested in the data than the application and so never installed it and am unable to comment on how usable it is, but will include a link if you want to look. https://sourceforge.net/projects/artha/ https://sourceforge.net/projects/artha/

deleted 1y ago

[deleted]

jeffWrld 1y ago

[dead]

johnklos 1y ago

Their reaction reminds me of when the Raspberry Pi Foundation tried gaslighting us. RPi Foundation hires a cop and brags about how cop used RPis to spy on people. People got upset. RPi Foundation acts clueless and says vegetarians and vegans were upset because they posted a picture of meat. Now Debian is less concerned with their core tenets and more concerned with winning popularity contests, as can be evidenced by their dropping of i386 support, for instance. Instead of seeing an issue like this and raising an alarm, examining how this possibly happened, and discussing ways of making sure it doesn't happen again, they're like, "eh, so what?" Debian, which for ages was the last big holdout of Linuxes becoming corporate, seems to have a bleak future.

hoppp 1y ago

Its a key stealing malware? Damn good I dont use it

pbohun 1y ago

I don't understand why the whole thing isn't local. A comprehensive Chinese dictionary has less than 400k words. Even at 1k per word that's less than 400MB. It's just poor design to make something require a network connection when it could work offline locally.

slanterns 1y ago
Then we should have a copy-left dictionary first.

737min 1y ago

Should some open source contributors & maintainers be considered an APT group and tracked thecsame way?

sneak 1y ago

Apple did something similar in 2015: CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3774 https://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html https://lists.apple.com/archives/security-announce/2015/Aug/... You had to three-finger press to trigger it, though. Similarly, it used unencrypted HTTP. I reported it and it was fixed to use TLS. The dev defending this unencrypted behavior is really wild, though.

koito17 1y ago
Most Chinese sites do not use HTTPS. In fact, TLS 1.3 traffic seems to be completely blocked within China's internet.[1] The decision to use plain HTTP is only strange from a Western viewpoint. Note: I am not defending this behavior. I still remember the era of ISPs injecting content into webpages. But it's important to keep in mind our subset of the world does not reflect the rest of the world. [1] https://news.ycombinator.com/item?id=24093932 https://news.ycombinator.com/item?id=24093932
- sneak 1y ago
  It does reflect the rest of the world; China is the extreme outlier here. Also, accessing GitHub from within mainland China works, so TLS is not completely banned.

utbabya 1y ago

Whatever is making plain HTTP requests in 2025 should be a cause of concern. Wouldn't it be nice to have a low resource daemon watching for common pitfalls alerting users so we eliminate or minimise classes of problems like this? I think lots of windows antivirus come with features like this? Perhaps with vast crystalized kno eledge nowadays we can afford to create OSS system level package that offers some level of protection. I might actually do it, any down side?

kingforaday 1y ago

Anyone else see the old UA string in strace out: User-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98) Also the \r\n in the output is irregular too.

neverrroot 1y ago
Signature, a distinctive signature that looks like.

asveikau 1y ago

I honestly don't think x11 is the primary problem. The package maintainer not thinking it's a big deal to send this data over http by default wouldn't be a good situation on Wayland either. They wouldn't get the clipboard but they're still not responsible. I presume this program also has full access to the filesystem.

aakkaakk 1y ago

Docs is obviously designed to be misleading. If I would design a malware, this is how I would do it. Plausible deniability. Don’t fool yourself. Kick this shit, and people who develop it, out of debian asap.

weare138 1y ago

A society that balances cause and effect! Money is also balanced! Money flows perfectly through multiple lifetimes! Being respected ultimately leads to balance! What?

rapiz 1y ago

Some context for ppl who are not paranoid, it's a very old software and not very maintained since very long time ago. I'm pretty sure HTTPS was not common at the time. And the selection scanning a very common and wanted feature in many alternatives for windows, browsers, etc. If there's anything we can learn from it - don't use obsolete software.