Macvim: Security: MacVim connects > camo.githubusercontent ?

Created on 27 Sep 2016 · 6Comments · Source: macvim-dev/macvim

I am not sure why MacVim is connecting to https://camo.githubuserconent.com. My first thought was perhaps this is a plugin package that I installed. However, this outgoing connection seems to be originating in the brew cellar. (I install MacVim via Homebrew)

Using LittleSnitch, I see the following outgoing connection modal...

screen shot 2016-09-27 at 10 27 30 am

Here is why I am suspicious:

Camo is: "an http proxy to route images through SSL" https://github.com/atmos/camo

Why would MacVim be doing anything at all with images?

Can anyone tell me if this is an intended part of the MacVim architecture, and if so, why?

Source

F1LT3R

Most helpful comment

I'd guess this is just the Sparkle updater accessing the appcast at https://raw.githubusercontent.com/macvim-dev/macvim/gh-pages/appcast/latest.xml. Both raw.githubusercontent.com and camo.githubusercontent.com are CNAME to the same CDN domain, and Little Snitch is known to show cached DNS information (so if another application accessed the camo subdomain recently, then LS is likely to show you that instead of raw)

MishimaHaruna on 27 Sep 2016

👍3

All 6 comments

I do not see anything related to camo in my .vim directory or bundle directory using cd ~/.vim && grep "camo\.github" * -nri

F1LT3R on 27 Sep 2016

Hm, I can't confirm this behaviour, not even if I update all of the plugins in MacVim via :PluginInstall!. (I've compiled MacVim from the github sources.)

best regards
Mario

guenti on 27 Sep 2016

Yes I've had trouble re-creating this too and can't find camo.githubusercontent in the mavcim source, although I did find .githubusercontent in the source, so the only things I can think of are: 1) github redirected something to camo.githubusercontent, 2) Little Snitch is wrong, 3) some other process was making outgoing connections through macvim.

F1LT3R on 27 Sep 2016

I will keep an eye on it and let you know if it comes up again. I bought it up in case macvim was being exploited to somehow share user content via github.

F1LT3R on 27 Sep 2016