Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: X11 desktop widget that shows location of your network peers on a map

github.com

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#11

Post by floating-io »

h2337 wrote: post #9
floating-io wrote: post #6

Earlier quoted context omitted.

Assuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats... That's just off the top of my head; I've not written in C in a while.

Why would you want to trigger a buffer overflow in user application if you can already control HOME envvar?

Yeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?).

As to what could be accomplished with an overflow? I don't know; I'm not in security, and I don't sit around thinking of possible uses for various bugs when it comes to compromising systems.

Perhaps the most important thing to realize, though, is that you're distributing software publicly. Your security situation may not be the same as your user's security situation. Assumptions should not be made.

Something to keep in mind.

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#13

Post by josephcsible »

wslh wrote: post #3

No basically secure: char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);

While that's indeed a bug, for it to be a security vulnerability, wouldn't there also have to be a security boundary involved? Specifically, mapName is always either "w1000b.png" or "w1000.png", so the only way to trigger the buffer overflow would be through the HOME environment variable. But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned? What would anyone gain by running your program and exploiting it to do something, rather than just doing the thing directly? https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#14

Post by h2337 »

floating-io wrote: post #11
h2337 wrote: post #9

Earlier quoted context omitted.

Why would you want to trigger a buffer overflow in user application if you can already control HOME envvar?

Yeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?). As to what could be accomplished with an overflow? I don't know; I'm…

Thanks for the discussion. Fix is already committed.

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#15

Post by floating-io »

h2337 wrote: post #14
floating-io wrote: post #11

Earlier quoted context omitted.

Yeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?). As to what could be accomplished with an overflow? I don't know; I'm…

Thanks for the discussion. Fix is already committed.

No problem. =)

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#17

Post by h2337 »

rootbear wrote: post #16

Forgive my ignorance, but I'm not sure what this is showing me. I'm running it on my home linux system, which is connected to the Internet via Verizon FIOS. The map shows three red dots, none of which are near me.

Those 3 dots are your peers, the other end of the TCP connection :)

So you basically have some apps running in the background (or foreground) that are making those connections.

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#18

Post by rootbear »

h2337 wrote: post #17
rootbear wrote: post #16

Forgive my ignorance, but I'm not sure what this is showing me. I'm running it on my home linux system, which is connected to the Internet via Verizon FIOS. The map shows three red dots, none of which are near me.

Those 3 dots are your peers, the other end of the TCP connection :) So you basically have some apps running in the background (or foreground) that are making those connections.

Okay, got it, thanks. I suppose it could also be the FIOS router itself making those connections, or any of the other systems on my local network.

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#19

Post by h2337 »

rootbear wrote: post #18
h2337 wrote: post #17

Earlier quoted context omitted.

Those 3 dots are your peers, the other end of the TCP connection :) So you basically have some apps running in the background (or foreground) that are making those connections.

Okay, got it, thanks. I suppose it could also be the FIOS router itself making those connections, or any of the other systems on my local network.

No, for normal network configurations they wouldn't show. It's most likely your system connmap is running on making those connections.

Re: Show HN: X11 desktop widget that shows location of your network peers on a map

#20

Post by positron26 »

h2337 wrote: post #17
rootbear wrote: post #16

Forgive my ignorance, but I'm not sure what this is showing me. I'm running it on my home linux system, which is connected to the Internet via Verizon FIOS. The map shows three red dots, none of which are near me.

Those 3 dots are your peers, the other end of the TCP connection :) So you basically have some apps running in the background (or foreground) that are making those connections.

Maybe they were expecting first hops like from traceroute. Maybe traceroute is an interesting way to continue developing.
Post reply on HN