7 ms·

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature.

> In response, Xiao pointed out that the package description can be read by any user who chooses to install the software, and it does mention the scan feature. Wouldn't be the first (or last) time a Debian maintainer has pulled the "you should read the descriptions of all (hundreds) of your packages (most installed as dependencies)" card in response to a bug report. If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them.

jacquesm 1y ago
Such responses to me are proof of malicious intent.
- avhception 1y ago
  While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
  - account42 1y ago
    We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs. Intent or not, that developer is a risk to the project.
    - vpribish 1y ago
      Finally, a rational argument from the torch and pitchfork crowd. Xiao is not taking security sensitivities to heart : HTTP?? To China‽ and a dismissive BS answer.
  - jacquesm 1y ago
    We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data. Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't even know what you've lost.
    - jona-f 1y ago
      [flagged]
      - jacquesm 1y ago
        He could have claimed lack of awareness until it was brought up. After that that excuse no longer holds.
        lyu07282 1y ago
        No they could still be just incompetent/negligent rather than malicious. You also forget that they aren't running the translation services, they don't get any data, that's a separate third party you'd have to believe are in on it too. The more important question is if debian is gonna gkick them for it (they should).
        jacquesm 1y ago
        That's a separate third party, with which they can be in cahoots, in fact it may not be that they are 'in on it too', it could well be that they are in fact the originators and sponsors of the way this works. Anyway, regardless of who is the culprit it is clear that the response spells 'wont fix' and that translates (in my book at least, pun intended) into 'works as intended'.
    - okasaki 1y ago
      [flagged]
    - rapiz 1y ago
      And yes, that IS the expected behavior. Select to translate is almost a standard feature for translation software. Not sure if the situation gets better now, but back then the software was written, using clipboard as temporary storage is a very robust and maybe the only way to implement such feature. Trivia: It's likely sending Ctrl+C and reading clipboard to get the selected text. No easy cross-platform API for this lol. Also note that the software is very old and poorly maintained.
  - JumpCrisscross 1y ago
    > it's still a far cry from "proof of malicious intent" Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion.
    - dotancohen 1y ago
      > Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion. We expel people for different values now? I'm not Christian, should I be expelled? Is there a defined set of values that one must uphold, or at least believe in theoretically, to be a welcome member?
      - JumpCrisscross 1y ago
        > We expel people for different values now? Yes, that's what core values mean. If they're not embraced by everyone, they cease to be core. If X11 tolerates developers who think piping data unseen to remote servers is okay, the project as a whole ceases to be trustworthy. > I'm not Christian, should I be expelled? From a listserv? No. From, like, a religious group? Maybe.
  - rangerelf 1y ago
    I disagree; it's basically lawyerspeak for "sucks to be you". If one is expected to go through all the documentation of both the main package and all dependency packages, and also through whatever specific configuration details to your case, just to be able to catch a specific IMPORTANT detail that's not clearly spelled out in the main package, that's malicious. "A dependency we use captures your clipboard data and sends it to remote servers" That sentence right there would kill their userbase, so they omit warning you about it. And on top of the "...user should have read the description..." non-apology, "just split the packages, bro". That's malicious.
    - sejje 1y ago
      > That sentence right there would kill their userbase No, it wouldn't. People don't take privacy very seriously.
      - devmor 1y ago
        If this were about a Windows or MacOS program, sure. The overlap between Linux desktop users and digital privacy concerns is pretty large.
      - bornfreddy 1y ago
        This is Debian, of course they do. But it wouldn't kill their userbase because nobody reads the package descriptions anyway.
  - ASalazarMX 1y ago
    It's clearly a defensive excuse, as it is extremely unrealistic to expect final users to read all the docs of all the dependencies of a Linux distro. It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's. It could be that they were caught with their pants down and posted an ill-thought response, but I'd lean strongly towards malice with such a poor defense, it borders on confession. Clipboards are one of the most critical privacy/security features, you don't ever want to leak them unintentionally. Did we already forget about the XZ Utils backdoor? There have to be multiple efforts to infiltrate backdoors in Linux going right now. https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor
    - Telaneo 1y ago
      > It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's. I agree a lot with this. You're supposed to trust your distributions packages. If you can't trust your distro, who can you trust? If you don't, find one you do trust, as that's a viable alternative. If none are trustworthy to you, then the only real option is to become your own package maintainer and have fun with Linux From Scratch.
- CorrectHorseBat 1y ago
  Malicious intent written in the package description? I would think that really unlikely. I think it's just a cultural difference. Sogou, a super popular Chinese input program for Windows iOS and Android does the same with everything you type and nobody cares.
  - jacquesm 1y ago
    I'd say that having terms of service that document your shady behavior whilst at the same time not making this obvious in the UI in any way is a tried and true (corporate) malware pattern. Just because Microsoft did it that doesn't make it a valid defense, in fact it shows the opposite (after all, they too did not have the best interests of their users at heart). The fact that the recipient of the data sits on the other side of the GFW and that clipboards can contain very interesting data you really should wonder about the intentions of the author, they do not get the benefit of the doubt. In fact, open source software that to all intents and purposes looks like it runs locally but pumps your (private) data out without your consent is a very large red flag to me: it gains access to data that otherwise likely would never be found in the wild. At a minimum this is a fairly serious GDPR violation.
  - npteljes 1y ago
    I think so too. It's cultural difference, and ignorance at most. I doubt the maintainer has control over that two random dictionary websites, or was tasked by them to do this or anything like that. They are just a different person, and they didn't give a fuck.
    - DonHopkins 1y ago
      [flagged]
      - npteljes 1y ago
        Yes, I do feel strongly about attributing malice to someone who I think didn't warrant it. Especially do I think that they are not malicious, because of the fact that they don't admit to their doing as a security hole, but as functionality. And I do care about security a lot - if this was on my software repository, I'd frankly pull the package until it's fixed. >why it's not malicious to write and distribute a program that sends passwords and other sensitive information over unencrypted http in 2025 One of the reasons is that it has been like that since at least 2009, so for 16 years. I'm not defending the bug. It's a glaringly stupid thing to do, and distribute, and it questions the competency of everyone involved. I do maintain that it's not malicious intent.
- npteljes 1y ago
  Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.
  - blackhaz 1y ago
    But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.
    - npteljes 1y ago
      I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731) - are they also malicious? I just think that not enough fucks were given.
      - jacquesm 1y ago
        It isn't rare at all for bugs to surface many years later and that doesn't mean whoever was responsible for maintenance to be malicious, it is if the bug was planted on purpose, and there are some examples of that (the xz library saga, for instance). Of course, you could argue that that too was incompetence but that's not how this works: lack of oversight by others does not imply malice on the part of those others for failure to catch the issue. Stuff like this can fly under the radar for a long time because lots of people will assume how it works without actually verifying that it really works like that.
        npteljes 1y ago
        I completely agree. Also, these people have a lot of other assignment, as I imagine. I, for one, have certainly let things slide in the past that ended up biting me, for whatever reason, malice not included.
- rusk 1y ago
  Such a response is not considered a valid defence under GDPR. You cannot sign away your right to privacy any more than you can sign away your right to life.
  - JumpCrisscross 1y ago
    > You cannot sign away your right to privacy any more than you can sign away your right to life You can literally do both in the EU with informed consent.
    - jacquesm 1y ago
      No, you can't. Informed consent is (1) always going to be specific and (2) ends when the legal base for procession is no longer supported.
      - JumpCrisscross 1y ago
        Struggling to see the relevance of both constraints when it comes to assisted death.
        jacquesm 1y ago
        I'm not going to fault you for that, but no, you really can not sign away your right-to-life even with assisted death. The process is explicitly tooled around this to ensure that people's rights are not violated. I am not saying that there will never be a mistake made here or even that that has not possibly already happened but in principle your right-to-life is not violated by this procedure, and I realize that I will not be able to convince you otherwise. That requires a complete re-thinking of your moral framework if you are not familiar with the concept. Just like for some people gay marriage is inconceivable and results in them being ready to man the barricades and for others it doesn't even move the needle. And then there is abortion and bodily autonomy. Large swathes of humanity are not going to be able to understand the remainder when it comes to those subjects, they all arrive at their own conclusions through a mixture of tradition, religion, philosophy and cultural exposure (media, mostly) as well as peer pressure. I've long ago decided that the only party that will hopefully be able to get all of those right using an objective frame of reference will be born a few thousand years from now, assuming humanity will make it that far.
- Lockal 1y ago
  There are dozens of chrome extensions that translate (read: submit to untrusted server) on hover / highlight / context menu / textarea edit / etc. It is implied, that user acknowledges this functionality and accepts the risk. This includes untrusted server (because that's how they proxy requests to Google/Bing/Yandex Translate without exposing API keys). Security illiteracy? Yes. Malicious intent? Probably no. Does being security illiterate equal malicious? Debatable.
  - jeltz 1y ago
    Not sure if I would call it malicious but I would call it gross negligence.
  - DonHopkins 1y ago
    [flagged]
    - Lockal 1y ago
      Illiterate is "inability to read and write" by definition. I know people who submitted bug reports requesting: "hi, I want to use your API, please add wildcard origin header", after getting explanation they propose "ok, JUST add my domain, I'm an opensource contributor, trust me". They ask to remove security features, recognizing them as security features, but only caring about their convenience (like "don't enforce 2fa", "don't warn about untrusted links"). They don't know about defense in depth and even if you explain them, they will skip your explanation, because they can't read.
    - guappa 1y ago
      The fix is to remove the package…
      - jacquesm 1y ago
        And to scan all of the other packages for phoning home without very explicitly informing the user about it and kicking them out if they don't.
- thegrimmest 1y ago
  Why can't reasonable people disagree here? Surely if the utility of some features might outweigh the security concerns for some people. Making features opt-in instead of opt-out significantly changes their discoverability and usage metrics. On the whole, a translation system that has a feature to translate selected text seems hardly surprising. Similarly, using an online service to improve translation quality and reduce local resource usage also seems reasonable. Fundamentally, always-online, home-phoning features are the norm, and it should be up to OS distributions to manage security postures such as allowlists for network access. Think something along the lines of "StarDict wants to connect to dict.cn. Allow/Deny?".
  - foresto 1y ago
    > Why can't reasonable people disagree here? They can, but framing this as a mere disagreement is disingenuous: One approach might slightly inconvenience someone, while the other (as was taken here) inflicts irreparable damage. > Fundamentally, always-online, home-phoning features are the norm, No. Although common on certain platforms, they are not a fundamental norm in software, nor should they be. In particular, we're talking about Debian here.
  - pabs3 1y ago
    > Think something along the lines of "StarDict wants to connect to dict.cn. Allow/Deny?". That is what opensnitch provides, as do some other detection tools. https://wiki.debian.org/PrivacyIssues#Detection_tools https://wiki.debian.org/PrivacyIssues#Detection_tools
- sim7c00 1y ago
  i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. how many times does everyone need to be totally compromised by some shitty software before people start to care? innocent individuals each days are suffering hacks and malicious interactions. people are losing their livelihoods. companies are getting shutdown... what more need to happen?? :S
  - thewebguyd 1y ago
    > i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. LLMs are only going to make this worse. We're going to see a plethora of vibe coded slop everywhere.
    - jacquesm 1y ago
      But think of the money saved!!
bayindirh 1y ago
"RTFM!" comments comes in flavors and bears nuances. In this case, as another commenter has pointed out, the answer smells fishy. I have been told to "RTFM!" countless times in many places. Some of them were legitimately the correct answer in that context, in hindsight. Some were knee-jerk reactions like this. Debian's discussion culture might be a little edgy sometimes, but this has nothing to do with Debian.
teiferer 1y ago
[flagged]
- JohnKemeny 1y ago
  You're fired!
  - DaiPlusPlus 1y ago
    Trump launched an Apprentice-themed LLM? le sigh…
    - colejohnson66 1y ago
      Too bad he doesn't know what an Nvidia is https://futurism.com/trump-didnt-know-nvidia https://futurism.com/trump-didnt-know-nvidia
- microtonal 1y ago
  Except that the description does not tell you that it ships off your clipboard unencrypted to Chinese servers.
jraph 1y ago
“the plans and the demolition orders have been on display at the local planning office on Alpha Centauri for fifty of your Earth years. If you can't be bothered to take an interest in local affairs...” https://www.youtube.com/watch?v=Z1Ba4BbH0oY https://www.youtube.com/watch?v=Z1Ba4BbH0oY
- tomsmeding 1y ago
  For the uninformed: this is a quote from The Hitchhiker's Guide to the Galaxy.
  - wolfi1 1y ago
    [flagged]
    - __MatrixMan__ 1y ago
      Yes, hence the comment
    - voidUpdate 1y ago
      There are probably a non-zero amount of people who are older than 20 who have not read the hitchhikers guide, or don't recall some parts of it. For example, me
      - Insanity 1y ago
        Same here! Last time I read the books is about 17 years ago, and definitely didn’t remember that.
        tapland 1y ago
        For me it’s been about 25, but since this is the opening premise, and a throwback to the opening scene I think it’s probably one of the most memorable.
        1y ago
wat10000 1y ago
That doesn’t even address the problem! The package description does mention the scan feature, but not the automatically-send-it-to-a-server-in-plain-text feature. Sure, if you read the description and the list of plugins and correctly guess how this plugin is implemented, then you can deduce some of it.
fodmap 1y ago
I do agree with your point, specially when it is not the first time a package maintained by that guy does non-expected behavior like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010165 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010165 (Inappropriate package, modifies other package's (conf) files, should be removed from archive).
- tremon 1y ago
  I disagree that "modifying other packages' conf files" is a problem. Conf files in general are there for the user to modify, and as the maintainer points out, it shouldn't matter if the user uses vi, joe, emacs or this specific tool to modify them. The problem in this case is that the package modifies generated files belonging to another package. Making it about conffiles is bad phrasing by the bug submitter.
deleted 1y ago
[deleted]
chainingsolid 1y ago
I install stuff from Debian's repos for 2 reasons. Convience & trust. And while people do complain when maintainers modify packages behavior, I think people would rather have the send my clipboard contents to someone else to be opt-in. Instead of violating their trust!
- zahlman 1y ago
  If this level of modification is required for a package to fit in with the distro's philosophy, maybe better not to include it at all.
  - m463 1y ago
    I think the answer might be to codify some of these assumptions. It might help set things apart from say ubuntu, which doesn't engender the same amount of trust such as opt-in.
juujian 1y ago
Also, someone looked at the package and the description, that is why this issue has been raised.
cesarb 1y ago
> If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them. That used to be viable back in the late 1990s and early 2000s when I first used Debian. It would take an afternoon of going through all the packages in dselect (does anyone here still remember dselect?) and marking the ones you wanted to install, and around the same amount of time going through every option on the kernel's menuconfig to precisely tailor the kernel to your specific hardware configuration (things were much less dynamic back then). Nowadays, there are simply too many packages and kernel configuration options to go through (also, does anyone still use dselect?).
1vuio0pswjnm7 1y ago
"If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them." Another option might be to reduce the amount of software one is "blindly"^1 using and relying upon For example, I have been making own Linux distribution, not following Linux from Scratch (although that is a useful reference) This is for both learning but also reliability and robustness purposes (where "robustness" includes ability to recover quickly from losing everything) IME starting from scratch gives a better appreciation for the "inconveniences" that maintainers must endure "Inconvenience" may be putting it mildly Certainly, the inconvenience varies depending on the software Some software builds even on the most deficient/broken installations Other software is absurdly difficult to compile, often due to minor oversights, sometimes due to obivous carelessness The wild inconsistencies from one project to another is itself part of the inconvenience The ease with which software can be compiled by me, and presumably anyone else, on any computer, including underpowered ones, with minimal dependencies, is among the factors I consider when choosing whether to rely on any particular software 1. Here "blindly" means the user has zero curiosity about where it comes from or how it works No comment on this particular software or the Debian maintainer I have up on X11 many years ago I never liked that Debian maintainers make subjective, opinionated changes to other peoples' software, especially since it seems like the majority of Debian users do not compile from source

jacquesm 1y ago

Such responses to me are proof of malicious intent.

avhception 1y ago
While I think the response was not well thought out, it's still a far cry from "proof of malicious intent".
- account42 1y ago
  We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs. Intent or not, that developer is a risk to the project.
  - vpribish 1y ago
    Finally, a rational argument from the torch and pitchfork crowd. Xiao is not taking security sensitivities to heart : HTTP?? To China‽ and a dismissive BS answer.
- jacquesm 1y ago
  We're not going to agree on that. The response is clearly there to point to a fig leaf instead of saying 'oh, oops, we will make this more obvious in the UI', the software is working as intended: as a way to gain access to more data. Note that clipboard data can be just about anything and is a valuable dataset, more so if the source of the data isn't aware of being a source, besides, there is no history so you won't even know what you've lost.
  - jona-f 1y ago
    [flagged]
    - jacquesm 1y ago
      He could have claimed lack of awareness until it was brought up. After that that excuse no longer holds.
      - lyu07282 1y ago
        No they could still be just incompetent/negligent rather than malicious. You also forget that they aren't running the translation services, they don't get any data, that's a separate third party you'd have to believe are in on it too. The more important question is if debian is gonna gkick them for it (they should).
        jacquesm 1y ago
        That's a separate third party, with which they can be in cahoots, in fact it may not be that they are 'in on it too', it could well be that they are in fact the originators and sponsors of the way this works. Anyway, regardless of who is the culprit it is clear that the response spells 'wont fix' and that translates (in my book at least, pun intended) into 'works as intended'.
  - okasaki 1y ago
    [flagged]
  - rapiz 1y ago
    And yes, that IS the expected behavior. Select to translate is almost a standard feature for translation software. Not sure if the situation gets better now, but back then the software was written, using clipboard as temporary storage is a very robust and maybe the only way to implement such feature. Trivia: It's likely sending Ctrl+C and reading clipboard to get the selected text. No easy cross-platform API for this lol. Also note that the software is very old and poorly maintained.
- JumpCrisscross 1y ago
  > it's still a far cry from "proof of malicious intent" Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion.
  - dotancohen 1y ago
    > Is the difference meaningful? It’s proof of a value set so different from the community’s as to merit the same response: expulsion. We expel people for different values now? I'm not Christian, should I be expelled? Is there a defined set of values that one must uphold, or at least believe in theoretically, to be a welcome member?
    - JumpCrisscross 1y ago
      > We expel people for different values now? Yes, that's what core values mean. If they're not embraced by everyone, they cease to be core. If X11 tolerates developers who think piping data unseen to remote servers is okay, the project as a whole ceases to be trustworthy. > I'm not Christian, should I be expelled? From a listserv? No. From, like, a religious group? Maybe.
- rangerelf 1y ago
  I disagree; it's basically lawyerspeak for "sucks to be you". If one is expected to go through all the documentation of both the main package and all dependency packages, and also through whatever specific configuration details to your case, just to be able to catch a specific IMPORTANT detail that's not clearly spelled out in the main package, that's malicious. "A dependency we use captures your clipboard data and sends it to remote servers" That sentence right there would kill their userbase, so they omit warning you about it. And on top of the "...user should have read the description..." non-apology, "just split the packages, bro". That's malicious.
  - sejje 1y ago
    > That sentence right there would kill their userbase No, it wouldn't. People don't take privacy very seriously.
    - devmor 1y ago
      If this were about a Windows or MacOS program, sure. The overlap between Linux desktop users and digital privacy concerns is pretty large.
    - bornfreddy 1y ago
      This is Debian, of course they do. But it wouldn't kill their userbase because nobody reads the package descriptions anyway.
- ASalazarMX 1y ago
  It's clearly a defensive excuse, as it is extremely unrealistic to expect final users to read all the docs of all the dependencies of a Linux distro. It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's. It could be that they were caught with their pants down and posted an ill-thought response, but I'd lean strongly towards malice with such a poor defense, it borders on confession. Clipboards are one of the most critical privacy/security features, you don't ever want to leak them unintentionally. Did we already forget about the XZ Utils backdoor? There have to be multiple efforts to infiltrate backdoors in Linux going right now. https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor
  - Telaneo 1y ago
    > It's the responsibility of the maintainer to read the subset of docs relevant to the package(s) they're contributing, not the user's. I agree a lot with this. You're supposed to trust your distributions packages. If you can't trust your distro, who can you trust? If you don't, find one you do trust, as that's a viable alternative. If none are trustworthy to you, then the only real option is to become your own package maintainer and have fun with Linux From Scratch.
CorrectHorseBat 1y ago
Malicious intent written in the package description? I would think that really unlikely. I think it's just a cultural difference. Sogou, a super popular Chinese input program for Windows iOS and Android does the same with everything you type and nobody cares.
- jacquesm 1y ago
  I'd say that having terms of service that document your shady behavior whilst at the same time not making this obvious in the UI in any way is a tried and true (corporate) malware pattern. Just because Microsoft did it that doesn't make it a valid defense, in fact it shows the opposite (after all, they too did not have the best interests of their users at heart). The fact that the recipient of the data sits on the other side of the GFW and that clipboards can contain very interesting data you really should wonder about the intentions of the author, they do not get the benefit of the doubt. In fact, open source software that to all intents and purposes looks like it runs locally but pumps your (private) data out without your consent is a very large red flag to me: it gains access to data that otherwise likely would never be found in the wild. At a minimum this is a fairly serious GDPR violation.
- npteljes 1y ago
  I think so too. It's cultural difference, and ignorance at most. I doubt the maintainer has control over that two random dictionary websites, or was tasked by them to do this or anything like that. They are just a different person, and they didn't give a fuck.
  - DonHopkins 1y ago
    [flagged]
    - npteljes 1y ago
      Yes, I do feel strongly about attributing malice to someone who I think didn't warrant it. Especially do I think that they are not malicious, because of the fact that they don't admit to their doing as a security hole, but as functionality. And I do care about security a lot - if this was on my software repository, I'd frankly pull the package until it's fixed. >why it's not malicious to write and distribute a program that sends passwords and other sensitive information over unencrypted http in 2025 One of the reasons is that it has been like that since at least 2009, so for 16 years. I'm not defending the bug. It's a glaringly stupid thing to do, and distribute, and it questions the competency of everyone involved. I do maintain that it's not malicious intent.
npteljes 1y ago
Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.
- blackhaz 1y ago
  But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.
  - npteljes 1y ago
    I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731) - are they also malicious? I just think that not enough fucks were given.
    - jacquesm 1y ago
      It isn't rare at all for bugs to surface many years later and that doesn't mean whoever was responsible for maintenance to be malicious, it is if the bug was planted on purpose, and there are some examples of that (the xz library saga, for instance). Of course, you could argue that that too was incompetence but that's not how this works: lack of oversight by others does not imply malice on the part of those others for failure to catch the issue. Stuff like this can fly under the radar for a long time because lots of people will assume how it works without actually verifying that it really works like that.
      - npteljes 1y ago
        I completely agree. Also, these people have a lot of other assignment, as I imagine. I, for one, have certainly let things slide in the past that ended up biting me, for whatever reason, malice not included.
rusk 1y ago
Such a response is not considered a valid defence under GDPR. You cannot sign away your right to privacy any more than you can sign away your right to life.
- JumpCrisscross 1y ago
  > You cannot sign away your right to privacy any more than you can sign away your right to life You can literally do both in the EU with informed consent.
  - jacquesm 1y ago
    No, you can't. Informed consent is (1) always going to be specific and (2) ends when the legal base for procession is no longer supported.
    - JumpCrisscross 1y ago
      Struggling to see the relevance of both constraints when it comes to assisted death.
      - jacquesm 1y ago
        I'm not going to fault you for that, but no, you really can not sign away your right-to-life even with assisted death. The process is explicitly tooled around this to ensure that people's rights are not violated. I am not saying that there will never be a mistake made here or even that that has not possibly already happened but in principle your right-to-life is not violated by this procedure, and I realize that I will not be able to convince you otherwise. That requires a complete re-thinking of your moral framework if you are not familiar with the concept. Just like for some people gay marriage is inconceivable and results in them being ready to man the barricades and for others it doesn't even move the needle. And then there is abortion and bodily autonomy. Large swathes of humanity are not going to be able to understand the remainder when it comes to those subjects, they all arrive at their own conclusions through a mixture of tradition, religion, philosophy and cultural exposure (media, mostly) as well as peer pressure. I've long ago decided that the only party that will hopefully be able to get all of those right using an objective frame of reference will be born a few thousand years from now, assuming humanity will make it that far.
Lockal 1y ago
There are dozens of chrome extensions that translate (read: submit to untrusted server) on hover / highlight / context menu / textarea edit / etc. It is implied, that user acknowledges this functionality and accepts the risk. This includes untrusted server (because that's how they proxy requests to Google/Bing/Yandex Translate without exposing API keys). Security illiteracy? Yes. Malicious intent? Probably no. Does being security illiterate equal malicious? Debatable.
- jeltz 1y ago
  Not sure if I would call it malicious but I would call it gross negligence.
- DonHopkins 1y ago
  [flagged]
  - Lockal 1y ago
    Illiterate is "inability to read and write" by definition. I know people who submitted bug reports requesting: "hi, I want to use your API, please add wildcard origin header", after getting explanation they propose "ok, JUST add my domain, I'm an opensource contributor, trust me". They ask to remove security features, recognizing them as security features, but only caring about their convenience (like "don't enforce 2fa", "don't warn about untrusted links"). They don't know about defense in depth and even if you explain them, they will skip your explanation, because they can't read.
  - guappa 1y ago
    The fix is to remove the package…
    - jacquesm 1y ago
      And to scan all of the other packages for phoning home without very explicitly informing the user about it and kicking them out if they don't.
thegrimmest 1y ago
Why can't reasonable people disagree here? Surely if the utility of some features might outweigh the security concerns for some people. Making features opt-in instead of opt-out significantly changes their discoverability and usage metrics. On the whole, a translation system that has a feature to translate selected text seems hardly surprising. Similarly, using an online service to improve translation quality and reduce local resource usage also seems reasonable. Fundamentally, always-online, home-phoning features are the norm, and it should be up to OS distributions to manage security postures such as allowlists for network access. Think something along the lines of "StarDict wants to connect to dict.cn. Allow/Deny?".
- foresto 1y ago
  > Why can't reasonable people disagree here? They can, but framing this as a mere disagreement is disingenuous: One approach might slightly inconvenience someone, while the other (as was taken here) inflicts irreparable damage. > Fundamentally, always-online, home-phoning features are the norm, No. Although common on certain platforms, they are not a fundamental norm in software, nor should they be. In particular, we're talking about Debian here.
- pabs3 1y ago
  > Think something along the lines of "StarDict wants to connect to dict.cn. Allow/Deny?". That is what opensnitch provides, as do some other detection tools. https://wiki.debian.org/PrivacyIssues#Detection_tools https://wiki.debian.org/PrivacyIssues#Detection_tools
sim7c00 1y ago
i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. how many times does everyone need to be totally compromised by some shitty software before people start to care? innocent individuals each days are suffering hacks and malicious interactions. people are losing their livelihoods. companies are getting shutdown... what more need to happen?? :S
- thewebguyd 1y ago
  > i agree. if in 2025 ppl dont understand plaintext of user data to places on the net is bad, they should not write code nor be maintainers of oss software -_-. LLMs are only going to make this worse. We're going to see a plethora of vibe coded slop everywhere.
  - jacquesm 1y ago
    But think of the money saved!!

bayindirh 1y ago

"RTFM!" comments comes in flavors and bears nuances. In this case, as another commenter has pointed out, the answer smells fishy. I have been told to "RTFM!" countless times in many places. Some of them were legitimately the correct answer in that context, in hindsight. Some were knee-jerk reactions like this. Debian's discussion culture might be a little edgy sometimes, but this has nothing to do with Debian.

teiferer 1y ago

[flagged]

JohnKemeny 1y ago
You're fired!
- DaiPlusPlus 1y ago
  Trump launched an Apprentice-themed LLM? le sigh…
  - colejohnson66 1y ago
    Too bad he doesn't know what an Nvidia is https://futurism.com/trump-didnt-know-nvidia https://futurism.com/trump-didnt-know-nvidia
microtonal 1y ago
Except that the description does not tell you that it ships off your clipboard unencrypted to Chinese servers.

jraph 1y ago

“the plans and the demolition orders have been on display at the local planning office on Alpha Centauri for fifty of your Earth years. If you can't be bothered to take an interest in local affairs...” https://www.youtube.com/watch?v=Z1Ba4BbH0oY https://www.youtube.com/watch?v=Z1Ba4BbH0oY

tomsmeding 1y ago
For the uninformed: this is a quote from The Hitchhiker's Guide to the Galaxy.
- wolfi1 1y ago
  [flagged]
  - __MatrixMan__ 1y ago
    Yes, hence the comment
  - voidUpdate 1y ago
    There are probably a non-zero amount of people who are older than 20 who have not read the hitchhikers guide, or don't recall some parts of it. For example, me
    - Insanity 1y ago
      Same here! Last time I read the books is about 17 years ago, and definitely didn’t remember that.
      - tapland 1y ago
        For me it’s been about 25, but since this is the opening premise, and a throwback to the opening scene I think it’s probably one of the most memorable.
        1y ago

wat10000 1y ago

That doesn’t even address the problem! The package description does mention the scan feature, but not the automatically-send-it-to-a-server-in-plain-text feature. Sure, if you read the description and the list of plugins and correctly guess how this plugin is implemented, then you can deduce some of it.

fodmap 1y ago

I do agree with your point, specially when it is not the first time a package maintained by that guy does non-expected behavior like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010165 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010165 (Inappropriate package, modifies other package's (conf) files, should be removed from archive).

tremon 1y ago
I disagree that "modifying other packages' conf files" is a problem. Conf files in general are there for the user to modify, and as the maintainer points out, it shouldn't matter if the user uses vi, joe, emacs or this specific tool to modify them. The problem in this case is that the package modifies generated files belonging to another package. Making it about conffiles is bad phrasing by the bug submitter.

deleted 1y ago

[deleted]

chainingsolid 1y ago

I install stuff from Debian's repos for 2 reasons. Convience & trust. And while people do complain when maintainers modify packages behavior, I think people would rather have the send my clipboard contents to someone else to be opt-in. Instead of violating their trust!

zahlman 1y ago
If this level of modification is required for a package to fit in with the distro's philosophy, maybe better not to include it at all.
- m463 1y ago
  I think the answer might be to codify some of these assumptions. It might help set things apart from say ubuntu, which doesn't engender the same amount of trust such as opt-in.

juujian 1y ago

Also, someone looked at the package and the description, that is why this issue has been raised.

cesarb 1y ago

> If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them. That used to be viable back in the late 1990s and early 2000s when I first used Debian. It would take an afternoon of going through all the packages in dselect (does anyone here still remember dselect?) and marking the ones you wanted to install, and around the same amount of time going through every option on the kernel's menuconfig to precisely tailor the kernel to your specific hardware configuration (things were much less dynamic back then). Nowadays, there are simply too many packages and kernel configuration options to go through (also, does anyone still use dselect?).

1vuio0pswjnm7 1y ago

"If someone started reading all the package descriptions and READMEs we're meant to be thoroughly familiar with when Trixie was released a few days ago, they'd still be reading them." Another option might be to reduce the amount of software one is "blindly"^1 using and relying upon For example, I have been making own Linux distribution, not following Linux from Scratch (although that is a useful reference) This is for both learning but also reliability and robustness purposes (where "robustness" includes ability to recover quickly from losing everything) IME starting from scratch gives a better appreciation for the "inconveniences" that maintainers must endure "Inconvenience" may be putting it mildly Certainly, the inconvenience varies depending on the software Some software builds even on the most deficient/broken installations Other software is absurdly difficult to compile, often due to minor oversights, sometimes due to obivous carelessness The wild inconsistencies from one project to another is itself part of the inconvenience The ease with which software can be compiled by me, and presumably anyone else, on any computer, including underpowered ones, with minimal dependencies, is among the factors I consider when choosing whether to rely on any particular software 1. Here "blindly" means the user has zero curiosity about where it comes from or how it works No comment on this particular software or the Debian maintainer I have up on X11 many years ago I never liked that Debian maintainers make subjective, opinionated changes to other peoples' software, especially since it seems like the majority of Debian users do not compile from source