bugGNU gettext - Bugs: bug #57847, Internet connection opened without...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57847: Internet connection opened without user consent by msginit

Submitted by:  Guido Flohr <gflohr>
Submitted on:  Tue 18 Feb 2020 07:57:18 AM UTC  
 
Category:  Translator tools Severity:  3 - Normal
Item Group:  None Status:  Not a Bug
Privacy:  Public Assigned to:  Bruno Haible <haible>
Open/Closed:  Closed

Sun 23 Feb 2020 07:59:24 PM UTC, comment #2: 

Regarding the User-Agent string: When urlget relies on the Java implementation, I'm disabling a too informative User-Agent string through
https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=commitdiff;h=c8fe23519e66963a2eb837a2c1209ffae8300ddd

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Sun 23 Feb 2020 06:20:23 PM UTC, comment #1: 

Nearly no sensitive data is transmitted:
- It's a fixed URL,
- No personal data (user name, gettext domain, language, ...) is included.

Only the User-Agent string contains unnecessary data; for this I've filed a bug report: bug #57884

See the attached files get-from-msginit-unencrypted-via-java.png and get-from-msginit-unencrypted-via-wget.png .

Before release 0.20, msginit used http; since release 0.20 it uses https. In this case, someone who snoops on the connection can only see a connection to translationproject.org happening from a non-browser environment. Only the translationproject.org site will get the User-Agent string information. But translationproject.org is a site we trust (since it holds the PO files for the packages).

I do agree that it is a good idea to ask the user before making internet requests that contain the hash sums of media files (VLC or QNAP do this) or other personal data. But here, no personal data is transferred.

Also the amount of data that is transmitted (in both directions) is small (< 50 KB) and therefore will not cause high costs over a mobile phone connection.

Therefore, asking the user in this case would be overkill.

Paranoid people can disconnect their machine from the internet or install a system-wide permission-to-connect system (pihole or such).


Bruno Haible <haible>
Project AdministratorIn charge of this item.
Tue 18 Feb 2020 07:57:18 AM UTC, original submission:  

The tool msginit tries to download an up-to-date copy of the translation team table from the internet.  The user is not prompted, before the connection is openened.  And there is also no commandline-option to opt out of it.

This behavior also seems to be undocumented.

A StackOverflow user has privacy concerns with that behavior (https://stackoverflow.com/questions/60244078/what-and-why-does-gnu-gettext-send-over-the-public-internet) and to be honest, I think he is right.

Guido Flohr <gflohr>
Project Member

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  • -email is unavailable- added by gflohr (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-23 haible Attached File- => Added get-from-msginit-unencrypted-via-java.png, #48484
        Attached File- => Added get-from-msginit-unencrypted-via-wget.png, #48485
        Attached File- => Added get-from-msginit-encrypted.png, #48486
        CategoryNone => Translator tools
        StatusNone => Not a Bug
        Assigned toNone => haible
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.5