StarDict sends X11 clipboard to remote servers (lwn.net)

Article summary

The StarDict dictionary application has a security issue where it sends user-selected text to remote servers over unencrypted HTTP by default. This happens when the 'scan' feature is enabled, which is the case in Debian's default configuration. The issue was reported to the oss-security mailing list and Debian's bug tracker, but the Debian package maintainer did not consider it a problem. The feature can be disabled, but some users may not be aware of the potential privacy concerns.

Main themes

• Security vulnerability
• Privacy concerns
• Dictionary software
• Linux distribution
• Default configuration
• Remote data transmission

What commenters say

• The StarDict application's behavior of sending user-selected text to remote servers is a serious privacy concern and should not be enabled by default.
• The issue is not just about the use of unencrypted HTTP, but also about the fact that the application is sending sensitive data to remote servers without user consent.
• Some users may find the 'scan' feature useful and want to use it, but they should be aware of the potential privacy risks and be given the option to disable it or use an offline dictionary instead.
• The Debian package maintainer's response to the issue was inadequate, and the default configuration of the application should be changed to prioritize user privacy.
• The use of Wayland instead of X11 may prevent this specific issue, but it is not a solution to the underlying problem of applications sending sensitive data to remote servers without user consent.
• The issue highlights the need for better privacy protections in Linux distributions and the importance of users being aware of the potential risks associated with certain applications and features.