PingerPlot Files

PingerPlot 1.3.3

A second audit pass: an external review (which reproduced its findings on a Linux network-namespace lab) plus a fresh read of the code. Several fixes change numbers the app reports; most of the rest are more places where something failed silently.

Changed

• Jitter is now the mean change between consecutive replies, not the standard deviation of RTT -- what the MOS E-model expects. Stddev scored a clean latency step after a reroute as sustained jitter and under-scored alternating latency. The Jitter column, exports, reports and MOS change with it; saved sessions recompute on load.

Fixed -- what the app reports

• A reroute could raise a false loss alert on a healthy destination: its alert window held a router's rate-limited TTL-exceeded replies. The window now counts only samples since the destination took its hop number.
• Linux: a busy Python thread showed up as network latency (GIL wait counted as RTT). Replies are now timed by the kernel (SO_TIMESTAMPNS), verified on CI's Linux runners on every push.
• All GUI targets wrote into one probe CSV; each now gets probe_<target>.csv.
• Per-target settings were lost on relaunch; each target's options are now saved and restored.
• macOS: parallel probes could take each other's replies; replies are now matched by sequence number. Untested on a Mac.
• The probe CSV rounded RTT to whole milliseconds; sub-ms values are kept.

Fixed -- silent failures

• A source IP the machine does not hold was ignored in TCP/UDP modes (TCP fell back to the default route, UDP never bound). Now refused in every mode with a message that says why.
• A probe-log rollover that failed (CSV open in Excel) thrashed on every probe and never enforced the size cap; a failed reopen stopped logging unannounced.
• Webhook failures were never reported.
• Headless printed no events at all: no alerts, route changes or warnings.
• Map lookups that failed while offline were cached as "no location" forever.
• Add / Start during a slow DNS lookup could wipe the new run's hops.
• One exception in a redraw froze the whole window.
• Malformed session files crashed the loader, left an empty row, and killed --baseline with a traceback.
• Stop all / closing / Ctrl-C stopped targets one at a time, adding up the waits.

Security

• The auto-start task's admin-only check looked at the py launcher, not the interpreter it picks from per-user state; and elevated Python still loaded user site-packages and PYTHONPATH. The task now registers the resolved interpreter, checks it and its stdlib, and elevated launches use -E -s.
• The release job no longer runs third-party code beside the write token: a read-only build job with hash-pinned build tools, and a separate publish job that runs only SHA-pinned actions and gh. Checkouts no longer persist the token in .git/config.

The executables are UNSIGNED; compare them against SHA256SUMS.txt.