Hacker Newsnew | past | comments | ask | show | jobs | submit | h2337's commentslogin

GitHub: https://github.com/h2337

Location: Baku, Azerbaijan (GMT +4)

Remote: Yes

Willing to relocate: No, but can travel from time to time

Technologies: TypeScript, Python, Go, Java, C++, Rust, Node.js, React, Spring, Django, PostgreSQL, MongoDB, Redis, ClickHouse, Docker, Kubernetes, etc.

Résumé/CV: Available upon request

Email: h2337@saturnine.cc

Senior software engineer with almost 9 years of professional experience. Full-stack with backend focus. Have worked in multiple EU/US companies remotely.

Feel free to email me for a copy of my resume.


Might add that soon as configurable option, thanks for suggestion!


Thanks for reporting. Will look into it soon.


Thanks for feedback! Will make it much more configurable as soon as I have time.


Correct! GeoIP database is local.


Nice! Where is it from, and do you know if it incorporates geofeed [1] data for networks that publish it?

[1] https://ipregistry.co/blog/geofeeds


Those 3 dots are your peers, the other end of the TCP connection :)

So you basically have some apps running in the background (or foreground) that are making those connections.


I'm colorblind and had to change the dots color. Might be a nice config option.


There's a 'good first issue'-labeled issue for this from 2023: https://github.com/h2337/connmap/issues/14


Maybe they were expecting first hops like from traceroute. Maybe traceroute is an interesting way to continue developing.


Okay, got it, thanks. I suppose it could also be the FIOS router itself making those connections, or any of the other systems on my local network.


No, for normal network configurations they wouldn't show. It's most likely your system connmap is running on making those connections.


It's only showing connections directly initiated by your computer. Not anything "upstream" of you like the FIOS router. It would also show any connections TO your computer, but being behind NAT on a normal home network, that would likely be nothing unless you've intentionally punched holes.


You might be surprised how much traffic every device makes.


Thanks for noticing! Fix pushed.


What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?


Assuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats...

That's just off the top of my head; I've not written in C in a while.


Why would you want to trigger a buffer overflow in user application if you can already control HOME envvar?


Yeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?).

As to what could be accomplished with an overflow? I don't know; I'm not in security, and I don't sit around thinking of possible uses for various bugs when it comes to compromising systems.

Perhaps the most important thing to realize, though, is that you're distributing software publicly. Your security situation may not be the same as your user's security situation. Assumptions should not be made.

Something to keep in mind.


Thanks for the discussion. Fix is already committed.


As long as you’re fixing that bug, you should do it right. If the return value from snprintf if more than 256 but less than a few GB then you should malloc a buffer big enough to hold the string and then call snprintf again with the new buffer. Only if that or malloc fails would you print an error. (It’s really a shame that the C standard library requires so many extra steps to do things correctly; this ought to be way easier.)


Not sure offhand how portable it is, but asprintf() handles automatic buffer allocation, thus not requiring any extra steps afaik.

It does exit on MacOS and Linux, at the very least.


Those are so unportable that I’d completely forgotten about them :)

But my man pages say that they exist on BSD in addition to GNU, so that’s pretty good these days. I say go for it.


No problem. =)


Using strcat to a fixed size buffer is like using a gun to kill flies in a crowded flophouse while on crystal meth.


Basically, any path longer than 256 characters for `mapFilename` would cause a buffer overrun.

An unprivileged app could run your app (say, with more privileges), with a very long `HOME` environment path, causing a buffer overflow, and potentially exploit it to use your app's privileges to do more stuff than it was supposed to.

Basically, you should never use strcpy and strcat and but use the secure alternatives like strcpy_s and strcat_s, even when you know the source buffer would never exceed the destination size.


> (say, with more privileges)

Isn't it a moot point if unprivileged app can already run anything with more privileges? In normal operation, connmap requires no special privileges.


Sure, but since there's no enforced standard for how privileges are configured on a system, there's always the possibility that your app to be the only escape ticket.

You can dismiss that possibility of course. But, as a general habit, it's best to use secure alternatives instead of mulling over probabilities every other line.

As a positive side-effect, the change would make your app not crash on systems with long HOME env paths.:)


I see you already addressed it but here let me give a scenario.

Say the program was installed and set so the user didn't have privs to modify the executable (so an attacker couldn't just change it to do what they want).

A buffer overflow could allow an attacker to gain control flow of the program and feed bogus data to the user allowing them to scrub their presence from the map.

Also, awesome project!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: