frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

The Micro-Front End Architecture Handbook

https://www.freecodecamp.org/news/complete-micro-frontends-guide/
1•thunderbong•41s ago•0 comments

Replit Agent deleted a $1M SaaS startup's production DB

2•Arindam1729•7m ago•2 comments

I´m migrating a webpage that uses Zend Framework 1. Do you have some advice?

1•sfebreiro•8m ago•0 comments

DailyMe: Write less. Do more. Feel better

https://apps.apple.com/us/app/dailyme-journal-your-ai-diary/id6745645320
1•gerardozaguirre•9m ago•2 comments

Capstone–modular platform for self-development, mastery tracking and AI coaching

https://www.theevolved.net
1•Poakess•11m ago•1 comments

Why Some Satellites Use NetBSD?

https://machaddr.substack.com/p/why-some-satellites-use-netbsd
1•Bogdanp•12m ago•0 comments

How to handle people dismissing io_uring as insecure?

https://github.com/axboe/liburing/discussions/1047
7•nromiun•13m ago•1 comments

SubTropolis and KC's Limestone Caves

https://kcyesterday.com/articles/subtropolis
1•taubek•17m ago•0 comments

Show HN: A simpler/cheaper alternative to Canny with a better free tier

https://www.userband.com/
1•ashbrother•19m ago•0 comments

Updating Your Brain's Software

http://happinessbeyondthought.blogspot.com/2018/03/updating-your-brains-software.html
1•andsoitis•22m ago•0 comments

Alaska Airlines grounds fleet nationwide

https://www.seattletimes.com/business/alaska-airlines-grounds-nationwide-fleet/
1•sugarpimpdorsey•22m ago•0 comments

Weak password allowed hackers to sink a 158-year-old company

https://www.bbc.co.uk/news/articles/cx2gx28815wo
1•mmarian•22m ago•0 comments

Build an Enterprise-Ready AI Powered Applicant Tracking System [video]

https://www.youtube.com/watch?v=iYOz165wGkQ
1•ent101•25m ago•0 comments

Knowledge Pillars and Certiport Global Partnership Announcement

https://knowledge-pillars.com/knowledge-pillars-and-certiport-global-partnership-announcement/
1•taubek•33m ago•0 comments

Show HN: I built a tool that generates Brat-style covers

https://bratgenerator.icu
1•kristoff200512•38m ago•0 comments

Ask HN: Advice on Offer

1•thathnwisdom•42m ago•1 comments

Perseids Meteor Shower Could Feature 50 to 100 Meteors per Hour

https://www.discovermagazine.com/the-sciences/the-2025-perseids-meteor-shower-could-feature-50-to-100-meteors-per-hour-and
1•danboarder•43m ago•0 comments

Rsyslog Goes AI

https://www.rsyslog.com/rsyslog-goes-ai-first-a-new-chapter-begins/
2•Deeg9rie9usi•44m ago•0 comments

Lightning Network has Failed [video]

https://www.youtube.com/watch?v=5Cq0C0SpbkY
1•richardanaya•47m ago•0 comments

Bright idea paves way for longer-lasting deep blue LEDs

https://cosmosmagazine.com/technology/materials/better-deep-blue-leds/
1•Bluestein•48m ago•0 comments

Microsoft releases emergency patches for SharePoint RCE flaw exploited in attack

https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-patches-for-sharepoint-rce-flaws-exploited-in-attacks/
2•DocFeind•50m ago•0 comments

Microsoft Response Point PBX System [video]

https://www.youtube.com/watch?v=nCPpkY1TD9Q
1•lurtbancaster•53m ago•0 comments

Dissecting the NVIDIA Blackwell Architecture with Microbenchmarks

https://arxiv.org/abs/2507.10789
1•matt_d•55m ago•0 comments

Delta Pilot Debriefs Cabin After Near Mid Air Collision with B52 Bomber

https://old.reddit.com/r/aviation/comments/1m49kz1/delta_pilot_debriefs_cabin_after_near_mid_air/
3•Onavo•58m ago•0 comments

SIMD Perlin Noise: Beating the Compiler with SSE

https://scallywag.software/vim/blog/simd-perlin-noise-i
2•homarp•1h ago•0 comments

Where can I sell a dataset I've created?

3•tflinton•1h ago•3 comments

Community Publishing Platform

https://hackernoon.tech/
1•smooke•1h ago•0 comments

ToolShell Mass Exploitation (CVE-2025-53770)

https://research.eye.security/sharepoint-under-siege/
2•panarky•1h ago•0 comments

Claude Code Helped Me Understand a Legacy Codebase in One Day

1•IgorGanapolsky•1h ago•0 comments

Show HN: The Next Modern Test By pytest-modern

https://github.com/zen-xu/pytest-modern
3•zen-xu•1h ago•1 comments
Open in hackernews

Show HN: X11 desktop widget that shows location of your network peers on a map

https://github.com/h2337/connmap
110•h2337•6h ago

Comments

wslh•5h ago
No basically secure:

char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);

h2337•5h ago
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
floating-io•5h ago
Assuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats...

That's just off the top of my head; I've not written in C in a while.

h2337•5h ago
Why would you want to trigger a buffer overflow in user application if you can already control HOME envvar?
floating-io•5h ago
Yeah, that is not a helpful attitude to take when it comes to this sort of thing. If nothing else, a super-long home path can crash your app and leave your user scratching their head. In other words, this is a bug (as is the fact that paths are not necessarily limited to 255 characters in the first place; see the PATH_MAX constant, I think it is?).

As to what could be accomplished with an overflow? I don't know; I'm not in security, and I don't sit around thinking of possible uses for various bugs when it comes to compromising systems.

Perhaps the most important thing to realize, though, is that you're distributing software publicly. Your security situation may not be the same as your user's security situation. Assumptions should not be made.

Something to keep in mind.

h2337•5h ago
Thanks for the discussion. Fix is already committed.
floating-io•5h ago
No problem. =)
db48x•2h ago
As long as you’re fixing that bug, you should do it right. If the return value from snprintf if more than 256 but less than a few GB then you should malloc a buffer big enough to hold the string and then call snprintf again with the new buffer. Only if that or malloc fails would you print an error. (It’s really a shame that the C standard library requires so many extra steps to do things correctly; this ought to be way easier.)
sedatk•5h ago
Basically, any path longer than 256 characters for `mapFilename` would cause a buffer overrun.

An unprivileged app could run your app (say, with more privileges), with a very long `HOME` environment path, causing a buffer overflow, and potentially exploit it to use your app's privileges to do more stuff than it was supposed to.

Basically, you should never use strcpy and strcat and but use the secure alternatives like strcpy_s and strcat_s, even when you know the source buffer would never exceed the destination size.

h2337•5h ago
> (say, with more privileges)

Isn't it a moot point if unprivileged app can already run anything with more privileges? In normal operation, connmap requires no special privileges.

sedatk•4h ago
Sure, but since there's no enforced standard for how privileges are configured on a system, there's always the possibility that your app to be the only escape ticket.

You can dismiss that possibility of course. But, as a general habit, it's best to use secure alternatives instead of mulling over probabilities every other line.

As a positive side-effect, the change would make your app not crash on systems with long HOME env paths.:)

DonHopkins•4h ago
Using strcat to a fixed size buffer is like using a gun to kill flies in a crowded flophouse while on crystal meth.
h2337•5h ago
Thanks for noticing! Fix pushed.
josephcsible•5h ago
While that's indeed a bug, for it to be a security vulnerability, wouldn't there also have to be a security boundary involved? Specifically, mapName is always either "w1000b.png" or "w1000.png", so the only way to trigger the buffer overflow would be through the HOME environment variable. But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned? What would anyone gain by running your program and exploiting it to do something, rather than just doing the thing directly? https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
im3w1l•3h ago
While exploitation is unlikely I think such things are still best avoided because multiple such things can sometimes be chained together.
ben0x539•5h ago
That's a really neat idea, damn.
rootbear•5h ago
Forgive my ignorance, but I'm not sure what this is showing me. I'm running it on my home linux system, which is connected to the Internet via Verizon FIOS. The map shows three red dots, none of which are near me.
h2337•5h ago
Those 3 dots are your peers, the other end of the TCP connection :)

So you basically have some apps running in the background (or foreground) that are making those connections.

rootbear•4h ago
Okay, got it, thanks. I suppose it could also be the FIOS router itself making those connections, or any of the other systems on my local network.
h2337•4h ago
No, for normal network configurations they wouldn't show. It's most likely your system connmap is running on making those connections.
esseph•2h ago
You might be surprised how much traffic every device makes.
jdwithit•53m ago
It's only showing connections directly initiated by your computer. Not anything "upstream" of you like the FIOS router. It would also show any connections TO your computer, but being behind NAT on a normal home network, that would likely be nothing unless you've intentionally punched holes.
positron26•4h ago
Maybe they were expecting first hops like from traceroute. Maybe traceroute is an interesting way to continue developing.
GranPC•4h ago
Pretty cool! Reminds me of the game Uplink.
apollo-zero•3h ago
Uplink! I loved that game. I should find it again.
itomato•4h ago
This seems like it belonged on freshmeat ca. Y2K.
djabatt•1h ago
must have at least once
lxgr•4h ago
Neat! This runs fully offline (i.e. without calls to a GeoIP database), right?
h2337•4h ago
Correct! GeoIP database is local.
lxgr•4h ago
Nice! Where is it from, and do you know if it incorporates geofeed [1] data for networks that publish it?

[1] https://ipregistry.co/blog/geofeeds

serbuvlad•4h ago
From what I was able to tell looking at the code, yes.

The database is embedded in the program. Specifically, it is this file:

https://github.com/h2337/connmap/blob/master/connmap/resourc...

Presumably generated by the author with this Python script

https://github.com/h2337/connmap/blob/master/tools/get-ip-da...

lxgr•4h ago
Ah, cool, this should incorporate location data at least as good as what the networks self-report! (I suspect that these databases, on top of ingesting all geofeed data, do something similar to Wi-Fi positioning, i.e. correlate the IP address of various GPS-enabled devices with their physical location to try and deduce undocumented/non-public allocation patterns.)
DonHopkins•4h ago
Of course it works fully offline, since then you don't have any network peers to draw on the map.
lxgr•4h ago
Localhost has to be somewhere too :)
DonHopkins•2h ago
GeoIP ain't gonna help you with geolocating 127.0.0.1! ;)

Not even Scientology's Secret Advanced Technology OT III Level Xenu Body Thetan and their high payed lawyers know where 127.0.0.1 is!

https://en.wikipedia.org/wiki/Xenu

https://news.ycombinator.com/item?id=14954131

DonHopkins on Aug 8, 2017 | parent | context | favorite | on: Internet Draft: Let 'localhost' be localhost

There was the time that Keith Henson tried to explain the local loopback address to Scientology lawyers during a deposition...

http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289

Henson: (patiently) It's at 127.0.0.1. This is a loop back address. This is a troll.

Lieberman: what's a troll?

Henson: it comes from the fishing where you troll a bait along in the water and a fish will jump and bite the thing, and the idea of it is that the internet is a very humorous place and it's especially good to troll people who don't have any sense of humor at all, and this is a troll because an ftp site of 127.0.0.1 doesn't go anywhere. It loops right back around into your own machine.

https://en.wikipedia.org/wiki/Keith_Henson

Keith is also involved with cryonics at Alcor, and known for performing "a rapid conversion to neuropreservation [that] was done using a high-speed electric chain saw".

https://news.ycombinator.com/item?id=34066097

>My somewhat eccentric friend Keith Henson once performed the grisly task of "converting whole body to neuro", which the article mentions: downgrading some of Alcor's full-body customers to head-only by removing their heads from their bodies with a chainsaw, or as Alcore's illustrated report delicately explained, "a rapid conversion to neuropreservation was done using a high-speed electric chain saw."

Chapter 3, pp 76, "Heads Will Roll", pp 93-94:

https://gwern.net/doc/transhumanism/1990-regis-greatmambochi...

>[...] But then the Alcor Life Extension Foundation came to the rescue. It would take care of the frozen parents, essentially on a charity basis, but only on the condition that they could be “converted” first, which is to say, converted from whole-body to neuro, the latter being far less expensive than the former. “The same capsule that you put a whole body in,” Saul Kent once explained, “you can probably put twenty heads in.”

freeone3000•3h ago
make sure interNIC is your first hop! LogDeleter is not optional <3
hamburglar•2h ago
This is some old school style bare bones C. popen with a big old pipe chain is pretty quick n dirty. I’d have gone digging around in proc for the active connections. Cool stuff though. I like that it’s so straightforward to read.
generalizations•1h ago
Of course this was made by an i3wm user. Nicely done!
rxwxx•1h ago
In the fonction IpRangeVector_resize() in ip.c, you have a bug, that's not how realloc are supposed to be used.
anthk•1h ago
OpenBSD devs did the same with either XPlanet or Xearth, can't rememeber. Now they use a GeoJson format.

Then you can import it under geo/viking port:

     doas pkg_add viking
Open Viking and just load the geo.json file from

        /usr/local/share/markers/OpenBSD.geojson
raldi•1h ago
What's a network peer?
atworkc•1h ago
Servers / Computers your device is currently communicating with, e.g. github servers when you load the link (well probably a cdn edge one)
jdwithit•59m ago
Yeah from an extremely quick read of the code, I agree with atworkc. It's showing any IP address you have an established network connection to.

  void refreshConnections() {
    ssOutput =
        popen("ss -atun4 | grep ESTAB | awk '{print $6}' | cut -f1 -d\":\"", "r");

    if (ssOutput == NULL) {
      printf("Failed to run ss command\n");
      exit(1);
    }
  }
edit: ssOutput is a global variable which is read elsewhere.