bugGNU gettext - Bugs: bug #57847, Internet connection opened without...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57847: Internet connection opened without user consent by msginit

Submitter:  Guido Flohr <gflohr>
Submitted:  Tue 18 Feb 2020 07:57:18 AM UTC
   
 
Category:  Translator tools Severity:  3 - Normal
Item Group:  None Status:  Not a Bug
Privacy:  Public Assigned to:  haible
Open/Closed:  Closed

Sun 23 Feb 2020 07:59:24 PM UTC, comment #2: 

Regarding the User-Agent string: When urlget relies on the Java implementation, I'm disabling a too informative User-Agent string through
https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=commitdiff;h=c8fe23519e66963a2eb837a2c1209ffae8300ddd

Bruno Haible <haible>
Group administrator
Sun 23 Feb 2020 06:20:23 PM UTC, comment #1: 

Nearly no sensitive data is transmitted:
- It's a fixed URL,
- No personal data (user name, gettext domain, language, ...) is included.

Only the User-Agent string contains unnecessary data; for this I've filed a bug report: bug #57884

See the attached files get-from-msginit-unencrypted-via-java.png and get-from-msginit-unencrypted-via-wget.png .

Before release 0.20, msginit used http; since release 0.20 it uses https. In this case, someone who snoops on the connection can only see a connection to translationproject.org happening from a non-browser environment. Only the translationproject.org site will get the User-Agent string information. But translationproject.org is a site we trust (since it holds the PO files for the packages).

I do agree that it is a good idea to ask the user before making internet requests that contain the hash sums of media files (VLC or QNAP do this) or other personal data. But here, no personal data is transferred.

Also the amount of data that is transmitted (in both directions) is small (< 50 KB) and therefore will not cause high costs over a mobile phone connection.

Therefore, asking the user in this case would be overkill.

Paranoid people can disconnect their machine from the internet or install a system-wide permission-to-connect system (pihole or such).


Bruno Haible <haible>
Group administrator
Tue 18 Feb 2020 07:57:18 AM UTC, original submission:  

The tool msginit tries to download an up-to-date copy of the translation team table from the internet.  The user is not prompted, before the connection is openened.  And there is also no commandline-option to opt out of it.

This behavior also seems to be undocumented.

A StackOverflow user has privacy concerns with that behavior (https://stackoverflow.com/questions/60244078/what-and-why-does-gnu-gettext-send-over-the-public-internet) and to be honest, I think he is right.

Guido Flohr <gflohr>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  • -email is unavailable- added by gflohr (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-23 haible Attached File- Added get-from-msginit-unencrypted-via-java.png, #48484
        Attached File- Added get-from-msginit-unencrypted-via-wget.png, #48485
        Attached File- Added get-from-msginit-encrypted.png, #48486
        CategoryNone Translator tools
        StatusNone Not a Bug
        Assigned toNone haible
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code