Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

151–160 of 467 posts

Re: I use zip bombs to protect my server

#151

Post by beeburrt »

pettycashstash2 wrote: post #143
socalgal2 wrote: post #111

Earlier quoted context omitted.

Jekyll and other static site generators do not repo Wordpress any more than notepad repos MSWord In one, multiple users can login, edit WYSIWYG, preview, add images, etc, all from one UI. You can access it from any browser including smart phones and tablets. In the other, you get to instruct users on git, how to deal with merge conflicts, code review (two people can't easily work on a post like they can in wordpress)…

what are your favorite static site generators? I googled it and cloudflare article came up with Jekyll,Gatsby,Hugo,Next.js, Eleventy. But would like to avoid doing research if can be helped on pros/cons of each.

Jekyll and GitHub pages go together pretty well.

Re: I use zip bombs to protect my server

#152

Post by astolarz »

sandworm101 wrote: post #95
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

Devide by zero happens to everyone eventually. https://medium.com/@bishr_tabbaa/when-smart-ships-divide-by-... "On 21 September 1997, the USS Yorktown halted for almost three hours during training maneuvers off the coast of Cape Charles, Virginia due to a divide-by-zero error in a database application that propagated throughout the ship’s control systems." " technician tried to digitally calibrate and reset the fuel…

Bad bot

Re: I use zip bombs to protect my server

#153

Post by mr_toad »

kulahan wrote: post #120
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

There probably aren’t any perfectly lossless compression algorithms, I guess? Nothing would ever be all zeroes, so it might not be an edge case accounted for or something? I have no idea, just pulling at strings. Maybe someone smarter can jump in here.

No lossless algorithm can compress all strings; some will end up larger. This is a consequence of the pigeonhole principle.

Re: I use zip bombs to protect my server

#154

Post by bigfatkitten »

donnachangstein wrote: post #93
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

> Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Someh…

A previous workplace of mine did the same with Netscape (and later, Mozilla) Composer. Users could modify content via WebDAV.

Re: I use zip bombs to protect my server

#155

Post by thayne »

jedberg wrote: post #131
thayne wrote: post #75

Earlier quoted context omitted.

Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…

I don't believe the client counts as a protected computer because they initiated the connection. Also a protected computer is a very specific definition that involves banking and/or commerce and/or the government.

Part B of the definition of "protected computer" says:

> which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

Assuming the server is running in the states, I think that would apply unless the client is in the same state as the server, in which case there is probably similar state law that comes into affect. I don't see anything there that excludes a client, and that makes sense, because otherwise it wouldn't prohibit having a site that tricks people into downloading malware.

Re: I use zip bombs to protect my server

#156

Post by colechristensen »

bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

>after 1 hour

I've used this teaching folks devops, here deploy your first hello world nginx server... huh what are those strange requests in the log?

Re: I use zip bombs to protect my server

#157

Post by dx4100 »

bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

There's ways that prevent it - - Freeze all code after an update through permissions - Don't make most directories writeable - Don't allow file uploads, or limit file uploads to media

There's a few plugins that do this, but vanilla WP is dangerous.

Re: I use zip bombs to protect my server

#158

Post by bobmcnamara »

layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image.

Years later I was finally able to open it.

Re: I use zip bombs to protect my server

#160

Post by fuzztester »

sandworm101 wrote: post #95
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

Devide by zero happens to everyone eventually. https://medium.com/@bishr_tabbaa/when-smart-ships-divide-by-... "On 21 September 1997, the USS Yorktown halted for almost three hours during training maneuvers off the coast of Cape Charles, Virginia due to a divide-by-zero error in a database application that propagated throughout the ship’s control systems." " technician tried to digitally calibrate and reset the fuel…

I remember reading about that some years ago. It involved Windows NT.

https://www.google.com/search?q=windows+nt+bug+affects+ship

Post reply on HN