Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

11–20 of 467 posts

Re: I use zip bombs to protect my server

#11

Post by codingdave »

theandrewbailey wrote: post #9
codingdave wrote: post #3

Mildly amusing, but it seems like this is thinking that two wrongs make a right, so let us serve malware instead of using a WAF or some other existing solution to the bot problem.

WAF isn't the right choice for a lot of people: https://news.ycombinator.com/item?id=43793526

At least, not with the default rules. I read that discussion a few days ago and was surprised how few callouts there were that a WAF is just a part of the infrastructure - it is the rules that people are actually complaining about. I think the problem is that so many apps run on AWS and their default WAF rules have some silly content filtering. And their "security baseline" says that you have to use a WAF and include their default rules, so security teams lock down on those rules without any real thought put into whether or not they make sense for any given scenario.

Re: I use zip bombs to protect my server

#12

Post by chmod775 »

codingdave wrote: post #3

Mildly amusing, but it seems like this is thinking that two wrongs make a right, so let us serve malware instead of using a WAF or some other existing solution to the bot problem.

Truly one my favorite thought-terminating proverbs.

"Hurting people is wrong, so you should not defend yourself when attacked."

"Imprisoning people is wrong, so we should not imprison thieves."

Also the modern telling of Robin Hood seems to be pretty generally celebrated.

Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong.

The spirit of the proverb is referring to wrongs which are unrelated to one another, especially when using one to excuse another.

Re: I use zip bombs to protect my server

#14

Post by cookiengineer »

xena wrote: post #7
cratermoon wrote: post #5

Earlier quoted context omitted.

Something like https://xeiaso.net/notes/2025/anubis-works/

I did actually try zip bombs at first. They didn't work due to the architecture of how Amazon's scraper works. It just made the requests get retried.

Did you also try Transfer-Encoding: chunked and things like HTTP smuggling to serve different content to web browser instances than to scrapers?

Re: I use zip bombs to protect my server

#15

Post by ycombinatrix »

zzo38computer wrote: post #10

I also had the idea of zip bomb to confuse badly behaved scrapers (and I have mentioned it before to some other people, although I did not implemented it). However, maybe instead of 0x00, you might use a different byte value. I had other ideas too, but I don't know how well some of them will work (they might depend on what bots they are).

The different byte values likely won't compress as well as all 0s unless they are a repeating pattern of blocks.

An alternative might be to use Brotli which has a static dictionary. Maybe that can be used to achieve a high compression ratio.

Re: I use zip bombs to protect my server

#16

Post by zzo38computer »

ycombinatrix wrote: post #15
zzo38computer wrote: post #10

I also had the idea of zip bomb to confuse badly behaved scrapers (and I have mentioned it before to some other people, although I did not implemented it). However, maybe instead of 0x00, you might use a different byte value. I had other ideas too, but I don't know how well some of them will work (they might depend on what bots they are).

The different byte values likely won't compress as well as all 0s unless they are a repeating pattern of blocks. An alternative might be to use Brotli which has a static dictionary. Maybe that can be used to achieve a high compression ratio.

I meant that all of the byte values would be the same (so they would still be repeating), but a different value than zero. However, Brotli could be another idea if the client supports it.

Re: I use zip bombs to protect my server

#17

Post by wiredfool »

xena wrote: post #7
cratermoon wrote: post #5

Earlier quoted context omitted.

Something like https://xeiaso.net/notes/2025/anubis-works/

I did actually try zip bombs at first. They didn't work due to the architecture of how Amazon's scraper works. It just made the requests get retried.

Amazon's scraper has been sending multiple requests per second to my servers for 6+ weeks, and every request has been returned 429.

Amazon's scraper doesn't back off. Meta, google, most of the others with identifiable user agents back off, Amazon doesn't.

Re: I use zip bombs to protect my server

#19

Post by imiric »

codingdave wrote: post #3

Mildly amusing, but it seems like this is thinking that two wrongs make a right, so let us serve malware instead of using a WAF or some other existing solution to the bot problem.

The web is overrun by malicious actors without any sense of morality. Since playing by the rules is clearly not working, I'm in favor of doing anything in my power to waste their resources. I would go a step further and try to corrupt their devices so that they're unable to continue their abuse, but since that would require considerably more effort from my part, a zip bomb is a good low-effort solution.
Post reply on HN