{"id":181262,"date":"2025-08-05T22:39:06","date_gmt":"2025-08-05T22:39:06","guid":{"rendered":"https:\/\/linuxiac.com\/?p=181262"},"modified":"2025-08-05T23:35:34","modified_gmt":"2025-08-05T23:35:34","slug":"stardict-plugins-in-debian-13-raise-privacy-concerns","status":"publish","type":"post","link":"https:\/\/linuxiac.com\/stardict-plugins-in-debian-13-raise-privacy-concerns\/","title":{"rendered":"StarDict Plugins in Debian 13 Raise Privacy Concerns"},"content":{"rendered":"\n

Debian 13 is just days away from launch<\/a>, and according to the developers<\/a>, all known bugs have been fixed\u2014so it\u2019s ready to roll. So far, so good. But a recent discussion around the upcoming Trixie release has raised some red flags. Here’s what’s going on.<\/p>\n\n\n\n

Vincent Lefevre, from France’s national institute for research in digital science and tech, has voiced serious concerns<\/a> about a potential privacy issue tied to one of the apps included in the final Debian 13 release. The app in question? StarDict<\/a>.<\/p>\n\n\n\n

It\u2019s totally normal if you\u2019ve never heard of it\u2014thankfully, the app isn\u2019t all that popular. We\u2019re talking about a dictionary lookup application that allows users to search for definitions, translations, and explanations of words using various dictionary databases.<\/p>\n\n\n\n

It uses online servers as a backend, and its GTK-based UI sends your search queries to them. So far, that all sounds pretty normal\u2014but here\u2019s where things start to get concerning.<\/p>\n\n\n\n

\"StarDict<\/a>
StarDict app running on Debian 13 (Trixie).<\/figcaption><\/figure>\n\n\n\n

When<\/span> used with certain plugins, it automatically sends user-selected text from any X11-based application over the internet to remote servers<\/strong>, without user consent or even a warning.<\/p>\n\n\n\n

While the package itself is described simply as a multilingual dictionary app, it automatically pulls in a plugin package (stardict-plugin<\/code>) via Debian’s Recommends mechanism. This plugin bundle includes network-based dictionary lookups that trigger on the system’s X11 selection\u2014essentially, any text a user highlights.<\/p>\n\n\n\n

Once triggered, StarDict sends the selected text in plaintext over HTTP to third-party servers in China<\/strong>, namely dict.youdao.com and dict.cn. And to make matters worse, these requests are made over unencrypted HTTP<\/strong>, making the data visible to anyone monitoring the network\u2014whether on a local LAN or through a compromised router.<\/p>\n\n\n\n

Let me break it down in simpler terms. Suppose you\u2019re running an X session on Debian 13 and you marked some text\u2014like your credit card number, username, password, or whatever\u2014to paste it somewhere else. In that case, that info is already silently on its way to servers in China without you even realizing it.<\/p>\n\n\n\n

Why? Because StarDict, with the stardict-plugin<\/code> installed, automatically sends any text you select to those servers\u2014and once again, it does so over plain, unencrypted HTTP. <\/p>\n\n\n\n

Now, you might think you’re safe as long as you don\u2019t install that plugin. I have news for you: it\u2019s a dependency for the GTK frontend, which Debian 13 installs and enables by default. So even if you never asked for it, it\u2019s already there, quietly doing its thing.<\/p>\n\n\n\n

\"The<\/a>
The stardict-plugin package is installed as a mandatory dependency for the main application.<\/figcaption><\/figure>\n\n\n\n

For example, to confirm what he said, Lefevre shows that when he selects “relation” in some application, a strace<\/code> on stardict<\/code> shows:<\/p>\n\n\n

911565<\/span> write(16<\/span>, \"GET HTTP:\/\/dict.youdao.com\/fsearch?q=relation HTTP\/1.0\\r\\nUser-Agent: Mozilla\/4.0(compatible;MSIE 5.00;Windows 98)\\r\\nAccept: *\/*\\r\\nHost: dict.youdao.com\\r\\nConnection: close\\r\\n\\r\\n\"<\/span>, 171<\/span>) = 171<\/span>\n911565<\/span> write(17<\/span>, \"GET HTTP:\/\/dict.cn\/ws.php?utf8=true&q=relation HTTP\/1.0\\r\\nUser-Agent: Mozilla\/4.0(compatible;MSIE 5.00;Windows 98)\\r\\nAccept: *\/*\\r\\nHost: dict.cn\\r\\nConnection: close\\r\\n\\r\\n\"<\/span>, 164<\/span>) = 164<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Be careful with StarDict! By default, when the application is running, it sends whatever the user selects (from other applications) to Chinese servers!<\/em><\/p>\n<\/blockquote>\n\n\n\n
A comment from a Debian developer<\/a> followed that\u2014I’ll let you be the judge of that.<\/p>\n\n\n\n
\n
Yes, that’s a feature: it will lookup your selections in local and online dictionaries, and by default it searches English-Chinese dictionaries. You can disable it in the settings by enabling “Only scan while the modifier key is being pressed” under “Scan Selection”, or disable the network dictionary plugins (dict.cn and youdao.com).<\/em><\/p>\n\n\n\n
If you use Wayland, application will be sandboxed by default, so it won’t be able to get selections from other apps anyway.<\/em><\/p>\n<\/blockquote>\n\n\n\n
Lefevre’s expected response<\/a> is more than reasonable:<\/p>\n\n\n\n
\n
Such a feature should have never been enabled by default.<\/em><\/p>\n<\/blockquote>\n\n\n\n
Feature? Seriously? I’d love to meet the user who installs StarDict and immediately heads to the settings to turn off this so-called “feature”\u2014or disables the plugin\u2019s network access entirely.<\/p>\n\n\n\n
I don\u2019t know how to put it any more plainly: this is absolutely unacceptable. And when we’re talking about Debian\u2014a project known for its commitment to open source, reliability, and user privacy\u2014it\u2019s honestly hard to wrap your head around how something like this made it through.<\/p>\n\n\n\n
Things get even more confusing when you realize that just a few years ago, this exact issue was reported as a CVE vulnerability in Debian (CVE-2009-2260<\/a>). But now, in Trixie, it\u2019s being treated as a feature. Honestly, I\u2019m not even sure what to say\u2014this whole thing just doesn\u2019t make any sense.<\/p>\n\n\n\n
Finally, to wrap things up, it\u2019s worth pointing out that this StarDict behavior can only happen in an X session. If you\u2019re running Debian 13 with Wayland, then you\u2019re safe, thanks to the protocol\u2019s sandboxed design. And at this point, I guess folks who think Wayland is some kind of big tech conspiracy being forced on users without good reason might want to rethink that stance.<\/p>\n\n\n\n
With Debian 13 just around the corner, my advice is simple: steer clear of StarDict. Yeah, it\u2019s 2025, and using an old-school desktop app like that is pretty unusual\u2014but still, you never know. If you care about your privacy, it\u2019s best just to avoid it altogether<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"
StarDict plugins on Debian 13 leak selected X11 text over HTTP to Chinese dictionary services, exposing potentially sensitive data.<\/p>\n","protected":false},"author":10,"featured_media":181271,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,5],"tags":[5921],"class_list":["post-181262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-os","category-news","tag-debian-13"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/181262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/comments?post=181262"}],"version-history":[{"count":0,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/181262\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media\/181271"}],"wp:attachment":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media?parent=181262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/categories?post=181262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/tags?post=181262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
In a message<\/a> to the Debian mailing list, Lefevre shares his concerns:<\/p>\n\n\n\n