Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

81–90 of 467 posts

Re: I use zip bombs to protect my server

#81

Post by thephyber »

echoangle wrote: post #68
bauruine wrote: post #60

Earlier quoted context omitted.

>User-agent: * >Disallow: /zipbomb.html Legitimate crawlers would skip it this way only scum ignores robots.txt

I’m not sure that’s enough, robots.txt isn’t really legally binding so if the zip bomb somehow would be illegal, guarding it behind a robots.txt rule probably wouldn’t make it fine.

Who, running a crawler which violates robots.txt, is going to prosecute/sue the server owner?

The server owner can make an easy case to the jury that it is a booby trap to defend against trespassers.

Re: I use zip bombs to protect my server

#83

Post by foxfired »

mahi_novice wrote: post #61

Do you mind sharing your specs of your digital ocean droplet? I'm trying to setup one with less cost.

The blog runs on a $6 digital ocean droplet. It's 1GB RAM and 25GB storage. There is a link at the end of the article on how it handles typical HN traffic. Currently at 5% CPU.

Re: I use zip bombs to protect my server

#84

Post by wewewedxfgdf »

sidewndr46 wrote: post #26
wewewedxfgdf wrote: post #18

I protected uploads on one of my applications by creating fixed size temporary disk partitions of like 10MB each and unzipping to those contains the fallout if someone uploads something too big.

What? You partitioned a disk rather than just not decompressing some comically large file?

Yes I'd rather deal with a simple out of disk space error than perform some acrobatics to "safely" unzip a potential zip bomb.

Also zip bombs are not comically large until you unzip them.

Also you can just unpack any sort of compressed file format without giving any thought to whether you are handling it safely.

Re: I use zip bombs to protect my server

#85

Post by marcusb »

Zip bombs are fun. I discovered a vulnerability in a security product once where it wouldn’t properly scan a file for malware if the file was or contained a zip archive greater than a certain size.

The practical effect of this was you could place a zip bomb in an office xml document and this product would pass the ooxml file through even if it contained easily identifiable malware.

Re: I use zip bombs to protect my server

#86

Post by cycomanic »

deathanatos wrote: post #57
xena wrote: post #7

Earlier quoted context omitted.

I did actually try zip bombs at first. They didn't work due to the architecture of how Amazon's scraper works. It just made the requests get retried.

So first, let me prefix this by saying I generally don't accept cookies from websites I don't explicitly first allow, my reasoning being "why am I granting disk read/write access to [mostly] shady actors to allow them to track me?" (I don't think your blog qualifies as shady … but you're not in my allowlist, either.) So if I visit https://anubis.techaro.lol/ (from the "Anubis" link), I get an infinite anime cat girl…

Just FYI temporary containers (Firefox extension) seem to be the solution you're looking for. It essentially generates a new container for every tab you open (subtabs can be either new containers or in the same container). Once the tab is closed it destroys the container and deletes all browsing data (including cookies). You can still whitelist some domains to specific persistent containers.

I used cookie blockers for a long time, but always ended up having to whitelist some sites even though I didn't want their cookies because the site would misbehave without them. Now I just stopped worrying.

Re: I use zip bombs to protect my server

#87

Post by unnouinceput »

kazinator wrote: post #65

I deployed this, instead of my usual honeypot script. It's not working very well. In the web server log, I can see that the bots are not downloading the whole ten megabyte poison pill. They are cutting off at various lengths. I haven't seen anything fetch more than around 1.5 Mb of it so far. Or is it working? Are they decoding it on the fly as a stream, and then crashing? E.g. if something is recorded as having read…

Do they comeback? If so then they detect it and avoid it. If not then they crashed and mission accomplished.

Re: I use zip bombs to protect my server

#89

Post by aaronbaugher »

carlosjobim wrote: post #78
sunaookami wrote: post #76

Earlier quoted context omitted.

Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either.

I've tried Drupal in the past for such situations, but it was too complicated for them. That was years ago, so maybe it's better now.

Re: I use zip bombs to protect my server

#90

Post by wincy »

carlosjobim wrote: post #78
sunaookami wrote: post #76

Earlier quoted context omitted.

Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

I do custom web dev so am way out of the website hosting game. What are good frameworks now if I want to say, light touch help someone who is slightly technical set up a website? Not full react SPA with an API.
Post reply on HN