6 ms·

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary we

Hanlon's razor applies here, I think. It's just ignorance, not malice. I doubt the maintainer has connection, or was pressured by these two random dictionary websites to include this - nor do I think that they gain any advantage of it. People need to be on the lookout though, the xz incident showed that FOSS is indeed vulnerable.

blackhaz 1y ago
But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.
- npteljes 1y ago
  I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731) - are they also malicious? I just think that not enough fucks were given.
  - jacquesm 1y ago
    It isn't rare at all for bugs to surface many years later and that doesn't mean whoever was responsible for maintenance to be malicious, it is if the bug was planted on purpose, and there are some examples of that (the xz library saga, for instance). Of course, you could argue that that too was incompetence but that's not how this works: lack of oversight by others does not imply malice on the part of those others for failure to catch the issue. Stuff like this can fly under the radar for a long time because lots of people will assume how it works without actually verifying that it really works like that.
    - npteljes 1y ago
      I completely agree. Also, these people have a lot of other assignment, as I imagine. I, for one, have certainly let things slide in the past that ended up biting me, for whatever reason, malice not included.
  - ploxiln 1y ago
    Debian maintainers in 2009 did not let it slide, they did fix it in 2009 ... but it came back, twice! (and it seems not many cared about StarDict in 2015 to fix it promptly that time) > the same kind of problem was reported by Pavel Machek in 2009 and again by "niekt0" in 2015. The 2009 bug was solved by patching the application's default configuration to disable networked dictionaries. That appears to have worked for a time, but the YouDao plugin, which was added in 2016, does not respect the configuration option. The 2015 problem was not fixed until August 6 of this year (although the package was removed from Debian for unrelated reasons for a few months from 2020 to 2021). That fix just removed the stardict_dictdotcn.so plugin, which also sent translation requests to dict.cn and was later subsumed by the YouDao plugin, from the package.
  - tremon 1y ago
    It cannot be ignorance if they have been fully aware of this behaviour. As it stands, it's either maliciousness or negligence.
poemxo 1y ago
I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.
- guappa 1y ago
  Can the problem be fixed without making the software useless?
  - npteljes 1y ago
    Absolutely. In my understanding and approach, it would need two smaller modifications: 1. making "scanning" (the clipboard capturing feature opt-in, with a huge notification for the implications 2. disabling the English-Chinese online translation plugin by default
  - jacquesm 1y ago
    Sure. We've had dictionary software for decades. This whole trend of adding a service to stuff that doesn't need a service is very annoying.
    - guappa 1y ago
      In that language…
      - tremon 1y ago
        Since it has been shown to be possible in other languages, why wouldn't it be?
        guappa 1y ago
        It is possible. If you have a free database to do that please upload it?
        deleted 1y ago
vorgol 1y ago
> pressured Maybe incentivized? $1000? $10000? Would be interesting to hear from the developer himself.
- npteljes 1y ago
  >nor do I think that they gain any advantage of it
  - ASalazarMX 1y ago
    I guess the companies receiving all this clipboard traffic are absorbing operational costs to humbly provide this surreptitious service to the world for free, and the package maintainer only wants to help them realize their mission. We truly live in an utopia!
frumplestlatz 1y ago
Willful negligence is, at some point, malicious.
chuckadams 1y ago
Sufficiently advanced ignorance is indistinguishable from malice. (but malware authors usually cover their tracks better)
dingnuts 1y ago
guy works for a Chinese media company and he's essentially trying to slip a backdoor into Debian systems. malice & typical CCP behavior IMHO. The responses from the maintainer are unacceptable and he should have his privileges stripped
more_corn 1y ago
No. The simplest answer is that they’re deliberately and maliciously exfiltrating data. The other explanation requires more hoops.

blackhaz 1y ago

But it cannot be adequately attributed to ignorance, so no, Hanlon's razor does not apply. There is an obvious security breach.

npteljes 1y ago
I definitely consider it a security breach. But I do still think it's ignorance. Debian maintainers let it slide since 2009, so for at least 16 years now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731) - are they also malicious? I just think that not enough fucks were given.
- jacquesm 1y ago
  It isn't rare at all for bugs to surface many years later and that doesn't mean whoever was responsible for maintenance to be malicious, it is if the bug was planted on purpose, and there are some examples of that (the xz library saga, for instance). Of course, you could argue that that too was incompetence but that's not how this works: lack of oversight by others does not imply malice on the part of those others for failure to catch the issue. Stuff like this can fly under the radar for a long time because lots of people will assume how it works without actually verifying that it really works like that.
  - npteljes 1y ago
    I completely agree. Also, these people have a lot of other assignment, as I imagine. I, for one, have certainly let things slide in the past that ended up biting me, for whatever reason, malice not included.
- ploxiln 1y ago
  Debian maintainers in 2009 did not let it slide, they did fix it in 2009 ... but it came back, twice! (and it seems not many cared about StarDict in 2015 to fix it promptly that time) > the same kind of problem was reported by Pavel Machek in 2009 and again by "niekt0" in 2015. The 2009 bug was solved by patching the application's default configuration to disable networked dictionaries. That appears to have worked for a time, but the YouDao plugin, which was added in 2016, does not respect the configuration option. The 2015 problem was not fixed until August 6 of this year (although the package was removed from Debian for unrelated reasons for a few months from 2020 to 2021). That fix just removed the stardict_dictdotcn.so plugin, which also sent translation requests to dict.cn and was later subsumed by the YouDao plugin, from the package.
- tremon 1y ago
  It cannot be ignorance if they have been fully aware of this behaviour. As it stands, it's either maliciousness or negligence.

poemxo 1y ago

I think Hanlon's razor is outdated. Plausible deniability is the new meta. On top of that, the maintainer seems intent on not fixing the problem.

guappa 1y ago
Can the problem be fixed without making the software useless?
- npteljes 1y ago
  Absolutely. In my understanding and approach, it would need two smaller modifications: 1. making "scanning" (the clipboard capturing feature opt-in, with a huge notification for the implications 2. disabling the English-Chinese online translation plugin by default
- jacquesm 1y ago
  Sure. We've had dictionary software for decades. This whole trend of adding a service to stuff that doesn't need a service is very annoying.
  - guappa 1y ago
    In that language…
    - tremon 1y ago
      Since it has been shown to be possible in other languages, why wouldn't it be?
      - guappa 1y ago
        It is possible. If you have a free database to do that please upload it?
        deleted 1y ago

vorgol 1y ago

> pressured Maybe incentivized? $1000? $10000? Would be interesting to hear from the developer himself.

npteljes 1y ago
>nor do I think that they gain any advantage of it
- ASalazarMX 1y ago
  I guess the companies receiving all this clipboard traffic are absorbing operational costs to humbly provide this surreptitious service to the world for free, and the package maintainer only wants to help them realize their mission. We truly live in an utopia!

frumplestlatz 1y ago

Willful negligence is, at some point, malicious.

chuckadams 1y ago

Sufficiently advanced ignorance is indistinguishable from malice. (but malware authors usually cover their tracks better)

dingnuts 1y ago

guy works for a Chinese media company and he's essentially trying to slip a backdoor into Debian systems. malice & typical CCP behavior IMHO. The responses from the maintainer are unacceptable and he should have his privileges stripped

more_corn 1y ago

No. The simplest answer is that they’re deliberately and maliciously exfiltrating data. The other explanation requires more hoops.