> In my opinion, nobody should use Deluge.

That's pretty harsh for the client just not supporting one non-essential feature. Many power users of Deluge or other torrent clients run it on seedboxes where a proxy isn't needed and would also negatively impact the speed.

It's not about whether the client supports one non-essential feature or not.

It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something.

There's 10 comments by the main developer (Cas) on that specific issue. I wouldn't call that "silently ignores".

I support him on Patreon (https://www.patreon.com/deluge_cas) where he sometimes posts updates but it's clear that he's very busy with other things (Including going through an illness) so I'm not blaming some open source maintainer for picking up a 10 year old, apparently hard to reproduce issue with a total of 45 comments.

The client can be used just fine, except for a small buggy behaviour in case if you are using a proxy which likely isn't used by the majority of users.

The application lets you configure a proxy, and then does not use the proxy. It ignores the proxy configuration without informing you. It silently ignores it. No amount of comments in a bug tracker changes that.

Oh but I don’t blame him either, it’s not a question of pointing fingers.

Saying it’s “likely isn’t used by the majority“ is bad form, in my opinion. You don’t know that. I don’t know either, to be sure, but it makes me personally lose faith in the security aspects of the project.

> It's about a project that silently ignores a privacy-related setting, which then exposes the fact that people download something.

Which means that everybody who either doesn't use a proxy or does not care whether it's exposed what they are downloading can happily use Deluge. Using the term "nobody" you are exaggerating quite a bit, don't you think?

Instead of complaining and demanding that others fix something for you for free who are not affected by it, please consider contributing a fix yourself.

You can route a BitTorrent client through a VPN. I do this with Docker + rtorrent + Wireguard. I agree silently ignoring proxy setting is not cool but assuming it is used for privacy reasons is a stretch. I'm glad it avoids people route Deluge data through Tor though that also would not be the sole purpose.

Thanks for pointing it out — yes, using “nobody” is exaggerating and I’ve edited it.

Note that I’m not demanding anything. Or complaining that it isn’t fixed. How could I? The person developing it, may have their reasons which I don’t know about.

However I am pointing out the issue, because there are more secure alternatives out there, if privacy is what you value.

I think they're ignoring it because in practice it is not much of an issue.

Some time ago, there was a Russian developer(s) who built a database that logged all IP addresses connecting to swarms. They then built a nice web frontend for it, to make it searchable. That’s how I found my IP address.

If you think that’s not much of an issue, that’s okay but I definitely didn’t like it.

It should be removed as an option, but in-application proxy leaks are also common. Application developers are typically not security experts, and built-in proxy implementations are frequently ancient or poorly implemented. Anyone very worried about privacy should be encouraged to use an audited modern alternative that tunnels all traffic from an interface or VM.

I've been running deluge in Linux since 2019 (version 2.0+, so considerably newer than the bug report) and it appeared to have been using my SOCKS5 proxy settings correctly; I had applied some extra hardening such as disabling natpmp etc, although I'm not sure if those are required.

However I don't doubt that these kind of leaks could have happened depending on configuration / bugs etc.

Eventually I ended up changing my configuration to run deluge in a VPN container (docker) network namespace so that I could use VPN port forwarding for better speeds (supported by Mullvad).

Out of curiosity, which feature of the client uses HTTP?

I thought BitTorrent was a protocol on top of e.g. TCP, is it carried inside HTTP by some clients?

Some trackers use http (if you look at a magnet link and see `&tr=http://mytracker.net`), and webseed uses http: https://www.bittorrent.org/beps/bep_0019.html

This is a really bad look, but I would think that if opsec is important to you, you won't have your proxy configuration in application level settings of a Python app. I think the people who would be concerned about this use system wide VPNs or seed boxes.

SOCKS is sometimes used as an additional layer to privacy. Stock system level VPN will continue without VPN if the VPN server somehow drops the connection.

If you are limiting the discussion to included stock VPN implementations, doesn’t that basically just include IPsec? Most secure third-party options will drop packets that aren’t destined for an encrypted tunnel, even while not running.

It's been a long time since I used Deluge and found that bug, but I think you're correct.

Nowadays I follow your advice and use a third-party option.

a system wide vpn doesn't always work. in some countries there are apps/websites that only work if they are accessed locally because they block access from outside.

Welp, it's open source, you've had 10 years to contribute a fix.

If you're going to downvote my comment, please explain in a subsequent comment why it's unreasonable to expect that if this is such an egregious bug, someone would've contributed a fix for it? Or at least, a reproducible test case?

Given they haven't, it's either not that egregious, or the people complaining are people who feel entitled to take without giving.

Which, tbh, probably describes a majority of users of torrent software.

it looks like people are misreading your comment. at least i did, at first. i thought you were piling on, addressing the maintainer, but on closer reading i realized that you were addressing the parent poster.

for what it's worth, i think you are absolutely right.

Well cheers, makes me think you contribute to FOSS too :)

any opportunity i get. which is sadly not often enough these days.

For you and everybody else complaining about this aspect: This is open source software. GPL licensed. It's provided as-is. You are free to use it and express what you think about it, and the maintainers are equally free to do with your opinion whatever they like, which includes ignoring it.

Clearly, none of the maintainers found this to be a problem. They likely don't need proxy settings for themselves. And they apparently also don't want to spend the time and energy to fix an issue that they don't have. That doesn't mean it's not an issue. It's just not an issue for them and they choose to do other things in life than fix it for you. Do you really demand somebody who already gave something to you for free to do even more work for free to implement something that they don't need themselves? Why would they do it? To get you to stop complain?

It's open source, you are free to go fix it yourself. This is Hacker News, lots of people on here should have the competence to fix this. Yet, in the last 10 years, apparently nobody found it so bad that they fixed it. It is clearly not impacting as many people as you make it sound like.

"Nobody should use Deluge" is an unsuitable statement, just because it has an issue in your use case. Many people don't have that use case, and of those who do, nobody bothered to fix it yet. Complaining doesn't fix anything.

What needs just as much fixing as the raised issue is your attitude towards open source.

I hate this philosophy of yours with all my might.

When you put something out there, you should strive to do right by your users. It is fine if you do not have time to fix a particular bug, but communication and asking for help should then be your priorities as maintainer. If 10 years of mostly silence on your part have passed, IMHO you have failed to be an effective open source maintainer.

I understand that open source doesn't offer you any rights or guarantees, but it does not have to be written in a contract to care about your software and its particular shortcomings.

Lastly, if you say a maintainer can do whatever they want with their software, I say that users should be free to be critical of it. There is no attitude in OP, they pointed out that a possibly major security bug still exists and people should be very careful about using it. Being open source doesn't mean nobody should dare criticise you.

> When you put something out there, you should strive to do right by your users.

We clearly disagree here.

I also like when some open source author is responsive after they put something out there. And I myself try to be helpful as well. After all, one of the reasons for me publishing things as open source is to attract a community that directly (through patches) or indirectly (through issue reports) helps me to improve the thing I made. Win-win!

But demanding this is actually actively hurtful to the ecosystem. To put it bluntly, would you prefer that somebody just doesn't publish some nice piece of software they wrote to scratch some itch they had just because they have no time/energy/desire to then provide support for users? I don't. I want them to publish it anyway. Maybe somebody else can pick up the maintenance. Or not, but at least it's out there.

> I hate this philosophy of yours with all my might.

"Hate" is a strong word. This is pretty sad.

Or, it's been 10 years because no-one has submitted a reproducible test-case.

At least, I don't see any in that bug report.

(apologies, this might be a bit snarky)

i hate this philosophy of yours with all my might. (ok, not really, but i do dislike it)

when i put something out there, i do it to share what i build for myself and for my own needs. i may be asking for help in general, but i won't ask for help for every specific issue unless that issue is a priority for my self and i can't fix it. time is to short to worry about every single low priority problem.

and how dare you judge someone elses effectiveness as a maintainer!

that, my friend, is quite an insult. you have no idea how effective they are. you don't live their life. you don't know what other responsibilities they have. what's next? asking that they commit a minimum number of hours each week for the project? demanding that they respond to any request within a day?

users should be free to be critical of it

absolutely not. you can say: "unfortunately, i have this problem, so i can't use this, i am going to go use something else". but that's about it.

criticism is the bane of our society. criticism hurts peoples feelings. criticism causes burnout. FOSS maintainers are volunteers and absolutely do not deserve that kind of criticism for just developing software. (that doesn't make them above any criticism. if they are rude or mean to their users, then that may well be criticized. but not if they ignore a problem or are unresponsive. they may well have other things in their life that are more important than to care about your software issue) (and if the developer is paid, direct any criticism at the company, but don't beat up the employee who may not have the freedom to choose what issues to work on)

Being open source doesn't mean nobody should dare criticise you

if you didn't pay for it, it means exactly that.

I agree that using “nobody” is not fair, and I’ve edited it. Note that in my opinion, the developers don’t need to do anything.