Linux

10965 readers

991 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

StarDict Plugins in Debian 13 Raise Privacy Concerns (linuxiac.com)

submitted 5 months ago by who@feddit.org to c/linux@programming.dev

7 comments fedilink hide all child comments

Details: https://seclists.org/oss-sec/2025/q3/75

CVE: https://nvd.nist.gov/vuln/detail/cve-2025-55014

top 7 comments

sorted by: hot top controversial new old

[–] kbal@fedia.io 12 points 5 months ago

The package maintainer appears to be out of his mind, but now that there's a CVE I hope it will get some attention from someone who can fix it.

[–] tazeycrazy@feddit.uk 8 points 5 months ago

Do we need the internet for word definitions. How big is a dictionary. Could you not just download the dictionary?

[–] Successful_Try543@feddit.org 8 points 5 months ago* (last edited 5 months ago) (1 children)

Once triggered, StarDict sends the selected text in plaintext over HTTP to third-party servers in China, namely dict.youdao.com and dict.cn. And to make matters worse, these requests are made over unencrypted HTTP, making the data visible to anyone monitoring the network—whether on a local LAN or through a compromised router.

...

Finally, to wrap things up, it’s worth pointing out that this StarDict behavior can only happen in an X session. If you’re running Debian 13 with Wayland, then you’re safe, thanks to the protocol’s sandboxed design. And at this point, I guess folks who think Wayland is some kind of big tech conspiracy being forced on users without good reason might want to rethink that stance.

[–] who@feddit.org -1 points 5 months ago* (last edited 5 months ago) (1 children)

And at this point, I guess folks who think Wayland is some kind of big tech conspiracy being forced on users without good reason might want to rethink that stance.

Unfortunately, Wayland still lacks some functionality that Xorg has, so switching would be a step backward for some people. Snarkily dismissing them as conspiracy theorists is wrong in several ways.

[–] Successful_Try543@feddit.org 3 points 5 months ago (1 children)

Unfortunately, Wayland still lacks some things that Xorg offers, so switching would be a step backward for some people. Snarkily dismissing them as conspiracy theorists is wrong in several ways.

I think the intersection between those who have valid reasons to use X11, e.g. missing features of Wayland, and those wo think Wayland is a 'big tech conspiracy' is small.

[–] who@feddit.org 1 points 5 months ago (1 children)

Does the latter group exist?

[–] Successful_Try543@feddit.org 4 points 5 months ago

Iirc, this was recently claimed in the initial release statement of the Xlibre fork of Xorg that wants to 'make X great again'