12 ms·
Show HN: X11 desktop widget that shows location of your network peers on a map
- deleted 1y ago[deleted]
- wslh 1y agoNo basically secure: char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);
- h2337 1y agoWhat's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
- floating-io 1y agoAssuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats... That's just off the top of my head; I've not written in C in a while.
- h2337 1y agoWhy would you want to trigger a buffer overflow in user application if you can already control HOME envvar?
- floating-io 1y agoYeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?). As to what could be accomplished with an overflow? I don't know; I'm not in security, and I don't sit around thinking of possible uses for various bugs when it comes to compromising systems. Perhaps the most important thing to realize, though, is that you're distributing software publicly. Your security situation may not be the same as your user's security situation. Assumptions should not be made. Something to keep in mind.
- h2337 1y agoThanks for the discussion. Fix is already committed.
- floating-io 1y agoNo problem. =)
- db48x 1y agoAs long as you’re fixing that bug, you should do it right. If the return value from snprintf if more than 256 but less than a few GB then you should malloc a buffer big enough to hold the string and then call snprintf again with the new buffer. Only if that or malloc fails would you print an error. (It’s really a shame that the C standard library requires so many extra steps to do things correctly; this ought to be way easier.)
- floating-io 1y agoNot sure offhand how portable it is, but asprintf() handles automatic buffer allocation, thus not requiring any extra steps afaik. It does exit on MacOS and Linux, at the very least.
- db48x 1y agoThose are so unportable that I’d completely forgotten about them :) But my man pages say that they exist on BSD in addition to GNU, so that’s pretty good these days. I say go for it.
- deleted 1y ago[deleted]
- sedatk 1y agoBasically, any path longer than 256 characters for `mapFilename` would cause a buffer overrun. An unprivileged app could run your app (say, with more privileges), with a very long `HOME` environment path, causing a buffer overflow, and potentially exploit it to use your app's privileges to do more stuff than it was supposed to. Basically, you should never use strcpy and strcat and but use the secure alternatives like strcpy_s and strcat_s, even when you know the source buffer would never exceed the destination size.
- h2337 1y ago> (say, with more privileges) Isn't it a moot point if unprivileged app can already run anything with more privileges? In normal operation, connmap requires no special privileges.
- sedatk 1y agoSure, but since there's no enforced standard for how privileges are configured on a system, there's always the possibility that your app to be the only escape ticket. You can dismiss that possibility of course. But, as a general habit, it's best to use secure alternatives instead of mulling over probabilities every other line. As a positive side-effect, the change would make your app not crash on systems with long HOME env paths.:)
- jfyi 1y agoI see you already addressed it but here let me give a scenario. Say the program was installed and set so the user didn't have privs to modify the executable (so an attacker couldn't just change it to do what they want). A buffer overflow could allow an attacker to gain control flow of the program and feed bogus data to the user allowing them to scrub their presence from the map. Also, awesome project!
- DonHopkins 1y agoUsing strcat to a fixed size buffer is like using a gun to kill flies in a crowded flophouse while on crystal meth.
- h2337 1y agoThanks for noticing! Fix pushed.
- josephcsible 1y agoWhile that's indeed a bug, for it to be a security vulnerability, wouldn't there also have to be a security boundary involved? Specifically, mapName is always either "w1000b.png" or "w1000.png", so the only way to trigger the buffer overflow would be through the HOME environment variable. But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned? What would anyone gain by running your program and exploiting it to do something, rather than just doing the thing directly? https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- im3w1l 1y agoWhile exploitation is unlikely I think such things are still best avoided because multiple such things can sometimes be chained together.
- sedatk 1y ago> But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned? Not unless they have another path for privilege escalation.
- ben0x539 1y agoThat's a really neat idea, damn.
- rootbear 1y agoForgive my ignorance, but I'm not sure what this is showing me. I'm running it on my home linux system, which is connected to the Internet via Verizon FIOS. The map shows three red dots, none of which are near me.
- h2337 1y agoThose 3 dots are your peers, the other end of the TCP connection :) So you basically have some apps running in the background (or foreground) that are making those connections.
- rootbear 1y agoOkay, got it, thanks. I suppose it could also be the FIOS router itself making those connections, or any of the other systems on my local network.
- h2337 1y agoNo, for normal network configurations they wouldn't show. It's most likely your system connmap is running on making those connections.
- esseph 1y agoYou might be surprised how much traffic every device makes.
- jdwithit 1y agoIt's only showing connections directly initiated by your computer. Not anything "upstream" of you like the FIOS router. It would also show any connections TO your computer, but being behind NAT on a normal home network, that would likely be nothing unless you've intentionally punched holes.
- positron26 1y agoMaybe they were expecting first hops like from traceroute. Maybe traceroute is an interesting way to continue developing.
- GranPC 1y agoPretty cool! Reminds me of the game Uplink.
- apollo-zero 1y agoUplink! I loved that game. I should find it again.
- itomato 1y agoThis seems like it belonged on freshmeat ca. Y2K.
- djabatt 1y agomust have at least once
- MarcelOlsz 1y agoWhat's that? Webarchive/google don't return much of anything.
- 28304283409234 1y agohttp://freshmeat.net http://freshmeat.net was a directory of open source software back in the 90's and noughts. It was one of the main ways to discover software. But what is X11? Is that like Wayland? ;-)
- pak9rabid 1y agoYep, my "package repo", if you will, for pretty much everything I installed on Slackware back in the day.
- teddyh 1y agoA modern equivalent is <https://freshcode.club/ https://freshcode.club/>
- vidarh 1y agoI was about to mention Aminet[1] too as a joke of sorts (it's Amiga focused, but still updated, though it stores the actual archives more than focus on the "news"), but scanned the front page on freshcode first and one of first things that stood out was an Amiga program[2]... If anything makes Freshcode a successor to Freshmeat, the only thing missing is an Enlightenment theme being posted too. [1] https://aminet.net/ https://aminet.net/ [2] https://freshcode.club/projects/apccomm https://freshcode.club/projects/apccomm
- lxgr 1y agoNeat! This runs fully offline (i.e. without calls to a GeoIP database), right?
- h2337 1y agoCorrect! GeoIP database is local.
- lxgr 1y agoNice! Where is it from, and do you know if it incorporates geofeed [1] data for networks that publish it? [1] https://ipregistry.co/blog/geofeeds https://ipregistry.co/blog/geofeeds
- serbuvlad 1y agoFrom what I was able to tell looking at the code, yes. The database is embedded in the program. Specifically, it is this file: https://github.com/h2337/connmap/blob/master/connmap/resources/ipv4.csv.zip https://github.com/h2337/connmap/blob/master/connmap/resourc... Presumably generated by the author with this Python script https://github.com/h2337/connmap/blob/master/tools/get-ip-database.py https://github.com/h2337/connmap/blob/master/tools/get-ip-da...
- lxgr 1y agoAh, cool, this should incorporate location data at least as good as what the networks self-report! (I suspect that these databases, on top of ingesting all geofeed data, do something similar to Wi-Fi positioning, i.e. correlate the IP address of various GPS-enabled devices with their physical location to try and deduce undocumented/non-public allocation patterns.)
- DonHopkins 1y agoOf course it works fully offline, since then you don't have any network peers to draw on the map.
- 1y ago
- freeone3000 1y agomake sure interNIC is your first hop! LogDeleter is not optional <3
- hamburglar 1y agoThis is some old school style bare bones C. popen with a big old pipe chain is pretty quick n dirty. I’d have gone digging around in proc for the active connections. Cool stuff though. I like that it’s so straightforward to read.
- quotemstr 1y ago> This is some old school style bare bones C. Which has now become some kind of meta-ironic fashion statement. It's 2025's going to the coffee shop with a typewriter.
- enriquto 1y agoit's more like taking notes with pen and pencil, while other patrons of the coffee shop use an electron-based note-taking "app" on their macbooks that uploads each keypress to the cloud, helpfully adding a half-second lag
- generalizations 1y agoOf course this was made by an i3wm user. Nicely done!
- rxwxx 1y agoIn the fonction IpRangeVector_resize() in ip.c, you have a bug, that's not how realloc are supposed to be used.
- h2337 1y agoThanks for reporting. Will look into it soon.
- anthk 1y agoOpenBSD devs did the same with either XPlanet or Xearth, can't rememeber. Now they use a GeoJson format. Then you can import it under geo/viking port: doas pkg_add viking Open Viking and just load the geo.json file from /usr/local/share/markers/OpenBSD.geojson
- raldi 1y agoWhat's a network peer?
- atworkc 1y agoServers / Computers your device is currently communicating with, e.g. github servers when you load the link (well probably a cdn edge one)
- jdwithit 1y agoYeah from an extremely quick read of the code, I agree with atworkc. It's showing any IP address you have an established network connection to. void refreshConnections() { ssOutput = popen("ss -atun4 | grep ESTAB | awk '{print $6}' | cut -f1 -d\":\"", "r"); if (ssOutput == NULL) { printf("Failed to run ss command\n"); exit(1); } } edit: ssOutput is a global variable which is read elsewhere.
- mhd 1y agoSomeone should make a windowmaker dockapp out of this.
- bit1993 1y agoDam! Great tool. Very clean. Thank you.
- kleiba 1y agoOne step closer to those futuristic screen interfaces you see in Hollywood blockbusters!
- Tom1380 1y agoI thought of doing something similar, it looks pretty cool. What about showing lines going through the various traceroute hops?
- h2337 1y agoMight add that soon as configurable option, thanks for suggestion!
- Aldipower 1y agoWorks also great with WindowMaker. I've added it to ~/GNUstep/Library/WindowMaker/autostart
- wing-_-nuts 1y agoUsing windowmaker in 2025 is certainly an ...interesting choice, though I admit the app probably looks like it fits right in with that aesthetic
- Aldipower 1y agoThere is even a beautiful Debian-based Window Maker distribution, called Window Maker Live. I am using this in a professional music studio as mixing workstation. https://wmlive.sourceforge.net/ https://wmlive.sourceforge.net/
- AlecSchueler 1y agoAre you using any old school audio software in your setup? How about outboard gear?
- lloeki 1y agoLittleSnitch has such a map feature https://help.obdev.at/littlesnitch6/lsm-map https://help.obdev.at/littlesnitch6/lsm-map Main difference would be that LS being actively handling connections the list is always accurate whereas this appears to poll current connections using `ss` so it may miss some if they happen to be entirely between two refresh beats.
- flux3125 1y agoAnother main difference is that LittleSnitch costs 59€ per license and is only for MacOS
- heikkilevanto 1y agoNice. My only gripe is that the map is not very easy to read, especially on the smaller sizes. There are too many coast lines and borders, so it can be hard to locate countries, especially in the Mediterranean. Would it be possible to draw land masses in solid (white?), and leave borders in dark (background color?). Other than that, works fine on Debian Linux and KDE. The map shows up on all desktops, which I like (but others might not) Another idea. Would it be possible to make the dots fade out, a little like in https://www.lightningmaps.org https://www.lightningmaps.org, so I could see some of the older traffic points as well?
- h2337 1y agoThanks for feedback! Will make it much more configurable as soon as I have time.
- globalnode 1y agoThis doesnt pick up short lived connections or sneaky udp connections right?
- waerhert 1y agoVery cool! I made something similar 12 years ago. https://github.com/waerhert/ikna/blob/master/screenshot.png https://github.com/waerhert/ikna/blob/master/screenshot.png
- DyslexicAtheist 1y agovery cool. works like a charm also on Sway in ~/.config/sway/config: for_window [class="connmap"] fullscreen enable cat ~/.config/connmap/connmaprc location_x 20 location_y 500 map_width 1920 black false update_interval 1 bonus: connect it to a right-click event either on the vpn or the network module in waybar "custom/wg":{ "format": "wg {icon} {text}", "exec": "~/.config/waybar/modules/wg", "return-type": "json", "interval": 5, "format-icons": ["",""], "on-click-right": "~/bin/connmap" },
- superkuh 1y agoconnmap wouldn't run on my retrocomputer with ancient Xorg 1.7.6 so I vibe coded a janky perl gtk2 version and it works. http://superkuh.com/connmap-perl-gtk2.pl.txt http://superkuh.com/connmap-perl-gtk2.pl.txt + http://tuvixdiedforoursins.org/w1000-old.png http://tuvixdiedforoursins.org/w1000-old.png (baked black background map) It looks pretty similar: http://tuvixdiedforoursins.org/connmap-perl-gtk2-screenshot.jpg http://tuvixdiedforoursins.org/connmap-perl-gtk2-screenshot.... vs http://tuvixdiedforoursins.org/connmap-original-screenshot.jpg http://tuvixdiedforoursins.org/connmap-original-screenshot.j...
- superkuh 1y agoAnd gtk3 for those running newer distros that kneecap themselves by not having gtk2 distributables, http://superkuh.com/connmap-perl-gtk3.pl.txt http://superkuh.com/connmap-perl-gtk3.pl.txt
- heikkilevanto 1y agoImpressive that the thing is less than 500 lines of pretty readable C