Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

161–170 of 467 posts

Re: I use zip bombs to protect my server

#161

Post by pessimizer »

overfeed wrote: post #97
tremon wrote: post #52

Earlier quoted context omitted.

That assumes they're using a stream decompressor library and are feeding that stream manually. Solutions that write the received file to $TMP and just run an external tool (or, say, use sendfile()) don't have the option to abort after N decompressed bytes.

> Solutions that write the received file to $TMP and just run an external tool (or, say, use sendfile()) don't have the option to abort after N decompressed bytes cgroups with hard-limits will let the external tool's process crash without taking down the script or system along with it.

> cgroups with hard-limits

This is exactly the same idea as partitioning, though.

Re: I use zip bombs to protect my server

#162

Post by malfist »

lillecarl wrote: post #103
1970-01-01 wrote: post #37

Earlier quoted context omitted.

Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.

Manual banning is about the same since you just book /56 or bigger, entire providers or countries. Automated banning is harder, you'd probably want a heuristic system and look up info on IPs. IPv4 with NAT means you can "overban" too.

Why wouldn't something like fail2ban not work here? That's what it's built for and has been around for eons.

Re: I use zip bombs to protect my server

#163

Post by malfist »

rtkwe wrote: post #126
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

It'd have to be more than one byte. There's the central directory, zip header, local header then the file itself you need to also tell it how many zeros to make when decompressing the actual file but most compression algorithms don't work like that because they're designed for actual files not essentially blank files so you get larger than the absolute minimum compression.

I mean, if I make a new compression algorithm that says a 10GB file of zeros is represented with a single specific byte, that would technically be compression.

All depends on how much magic you want to shove into an "algorithm"

Re: I use zip bombs to protect my server

#164

Post by msm_ »

ugurs wrote: post #129
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

It requires at leadt few bytes, there is no way to represent 10GB of data in 8 bits.

But of course there is. Imagine the following compression scheme:

    0-253: output the input byte
    254 followed by 0: output 254
    254 followed by 1: output 255
    255: output 10GB of zeroes
Of course this is an artificial example, but theoretically it's perfectly sound. In fact, I think you could get there with static huffman trees supported by some formats, including gzip.

Re: I use zip bombs to protect my server

#165

Post by pessimizer »

bilekas wrote: post #59
jawns wrote: post #54

Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?

Please, just as a conversational piece, walk me through the potentials you might think there are ? I'll play the side of the defender and you can play the "bot"/bot deployer.

Mantrapping is a fairly good analogy, and that's very illegal. If the person reading your gas meter gets caught in your mantrap, you're going to prison. You're probably going to prison if somebody burglarizing you gets caught in your mantrap.

https://en.wikipedia.org/wiki/Mantrap_(snare)

Of course their computers will live, but if you accidentally take down your own ISP or maybe some third-party service that you use for something, I'd think they would sue you.

Re: I use zip bombs to protect my server

#166

Post by opan »

bobmcnamara wrote: post #158
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd focus. Then I'd try to zoom or pan and it'd blur for ages again. I guess it was aggressively lazy-loading. What worked in the end was GIMP. I had the thought that the image was probably made in an editor, so surely an editor could open it. The catch is that it took like 8GB of RAM, but then I could see clearly, zoom, and pan all I wanted. It made me wonder why there's not an image viewer that's just the viewer part of GIMP or something.

Among things that didn't work were qutebrowser, icecat, nsxiv, feh, imv, mpv. I did worry at first the file was corrupt, I was redownloading it, comparing hashes with a friend, etc. Makes for an interesting benchmark, I guess.

For others curious, here's the file: https://0x0.st/82Ap.png

I'd say just curl/wget it, don't expect it to load in a browser.

Re: I use zip bombs to protect my server

#167

Post by justusthane »

pettycashstash2 wrote: post #143
socalgal2 wrote: post #111

Earlier quoted context omitted.

Jekyll and other static site generators do not repo Wordpress any more than notepad repos MSWord In one, multiple users can login, edit WYSIWYG, preview, add images, etc, all from one UI. You can access it from any browser including smart phones and tablets. In the other, you get to instruct users on git, how to deal with merge conflicts, code review (two people can't easily work on a post like they can in wordpress)…

what are your favorite static site generators? I googled it and cloudflare article came up with Jekyll,Gatsby,Hugo,Next.js, Eleventy. But would like to avoid doing research if can be helped on pros/cons of each.

I don’t have much experience with other SSGs, but I’ve been using Eleventy for my personal site for a few years and I’m a big fan. It’s very simple to get started with, it’s fast to build, it’s powerful and flexible.

I build mine with GitHub Actions and host it free on Pages.

Re: I use zip bombs to protect my server

#168

Post by cantrecallmypwd »

chmod775 wrote: post #12
codingdave wrote: post #3

Mildly amusing, but it seems like this is thinking that two wrongs make a right, so let us serve malware instead of using a WAF or some other existing solution to the bot problem.

Truly one my favorite thought-terminating proverbs. "Hurting people is wrong, so you should not defend yourself when attacked." "Imprisoning people is wrong, so we should not imprison thieves." Also the modern telling of Robin Hood seems to be pretty generally celebrated. Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong. The spirit of the proverb…

> "Hurting people is wrong, so you should not defend yourself when attacked."

This is exactly what Californian educators told kids who were being bullied in the 90's.

Re: I use zip bombs to protect my server

#170

Post by stavros »

sgc wrote: post #31
shishcat wrote: post #29

Earlier quoted context omitted.

This will waste your bandwidth and resources too

The idea is to trickle it very slowly, like keeping a cat occupied with a ball of fluff in the corner.

Yes but you still need to keep a connection open to them. This is a sort of reverse SlowLoris attack, though.
Post reply on HN