Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

131–140 of 467 posts

Re: I use zip bombs to protect my server

#131

Post by jedberg »

thayne wrote: post #75
jawns wrote: post #54

Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?

Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…

I don't believe the client counts as a protected computer because they initiated the connection. Also a protected computer is a very specific definition that involves banking and/or commerce and/or the government.

Re: I use zip bombs to protect my server

#132

Post by ChuckMcM »

leephillips wrote: post #117
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

These links do show up for humans who might be using text browsers, (perhaps) screen readers, bookmarklets that list the links on a page, etc.

true, but you can make the link text 'do not click this' or 'not a real link' to let them know. I'm not sure if crawlers have started using LLMs to check pages or not which would be a problem.

Re: I use zip bombs to protect my server

#133

Post by maxbond »

sidewndr46 wrote: post #36
gchamonlive wrote: post #33

Earlier quoted context omitted.

https://github.com/uint128-t/ZIPBOMB 2048 yottabyte Zip Bomb This zip bomb uses overlapping files and recursion to achieve 7 layers with 256 files each, with the last being a 32GB file. It is only 266 KB on disk. When you realise it's a zip bomb it's already too late. Looking at the file size doesn't betray its contents. Maybe applying some heuristics with ClamAV? But even then it's not guaranteed. I think a small pa…

What are you talking about? You get a compressed file. You start decompressing it. When the amount of bytes you've written exceeds some threshold (say 5 megabytes) just stop decompressing, discard the output so far & delete the original file. That is it.

That is exactly what OP is doing, they've just implemented it at the operating system/file system level.

Re: I use zip bombs to protect my server

#134

Post by santoshalper »

koolba wrote: post #80
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I hope you weren’t paying for bandwidth by the KiB.

Nah, back then we paid for bandwidth by the kb.

Re: I use zip bombs to protect my server

#135

Post by arcfour »

ianlevesque wrote: post #73
bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

Never use that junk if you value your sanity, I think you mean.

Re: I use zip bombs to protect my server

#136

Post by karaterobot »

felbane wrote: post #130
carlosjobim wrote: post #108

Earlier quoted context omitted.

By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of…

Does anyone actually still use jQuery? Everything I've built in the past like 5 years has been almost entirely pure ES6 with some helpers like jsviews.

jQuery's still the third most used web framework, behind React and before NextJS. If you use jQuery to build Wordpress websites, you'd be specializing in popular web technologies in the year 2025.

https://survey.stackoverflow.co/2024/technology#1-web-framew...

Re: I use zip bombs to protect my server

#137

Post by m463 »

layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

Sounds like the favicon.ico that would crash the browser.

I think this was it:

https://freedomhacker.net/annoying-favicon-crash-bug-firefox...

Re: I use zip bombs to protect my server

#138

Post by [deleted] »

philsnow wrote: post #127
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

A compressed file that is only one byte long can only represent maximally 256 different uncompressed files. Signed, a kid in the 90s who downloaded some "wavelet compression" program from a BBS because it promised to compress all his WaReZ even more so he could then fit moar on his disk. He ran the compressor and hey golly that 500MB ISO fit into only 10MB of disk now! He found out later (after a defrag) that the "co…

[deleted]

Re: I use zip bombs to protect my server

#139

Post by marcusf »

philsnow wrote: post #127
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

A compressed file that is only one byte long can only represent maximally 256 different uncompressed files. Signed, a kid in the 90s who downloaded some "wavelet compression" program from a BBS because it promised to compress all his WaReZ even more so he could then fit moar on his disk. He ran the compressor and hey golly that 500MB ISO fit into only 10MB of disk now! He found out later (after a defrag) that the "co…

man, a comment that brings back memories. you and me both.

Re: I use zip bombs to protect my server

#140

Post by carlosjobim »

felbane wrote: post #130
carlosjobim wrote: post #108

Earlier quoted context omitted.

By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of…

Does anyone actually still use jQuery? Everything I've built in the past like 5 years has been almost entirely pure ES6 with some helpers like jsviews.

Sure, why not? It's lightweight and works well, and there's a lot of good solutions that you can find already made for you online.
Post reply on HN