Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

341–350 of 467 posts

Re: I use zip bombs to protect my server

#341

Post by GTP »

M95D wrote: post #307
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

Could server-side includes be used for a html bomb? Write an ordinary static html page and fill a with infinite random data using . or would that crash the server?

I guess it depends on the server's implementation. but, since you need some logic to decide when to serve the html bomb anyway, I don't see why you would prefer this solution. Just use whatever script you're using to detect the bots to serve the bomb.

Re: I use zip bombs to protect my server

#342

Post by GTP »

amelius wrote: post #311
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

Maybe it's time for a /dev/zipbomb device.

ln -s /dev/urandom /dev/zipbomb && echo 'Boom!'

Ok, not a real zip bomb, for that we would need a kernel module.

Re: I use zip bombs to protect my server

#343

Post by thrwyep »

PeterStuer wrote: post #303

"On my server, I've added a middleware that checks if the current request is malicious or not" How accurate is that middleware? Obviously there are false negatives as you supplement with other heuristics. What about false positives? Just collateral damage?

I thought he maintains his own list of offenders

Re: I use zip bombs to protect my server

#345

Post by pandemic_region »

vidarh wrote: post #318
AStonesThrow wrote: post #298

Earlier quoted context omitted.

Wait, you set up a symlink? I am not sure how that could’ve worked. Unless the real /dev tree was exposed to your webserver’s chroot environment, this would’ve given nothing special except “file not found”. The whole point of chroot for a webserver was to shield clients from accessing special files like that!

You yourself explain how it could've worked: Plenty of webservers are or were not chroot'ed.

Which means that if your bot is getting slammed by this, you can assume it's not chrooted and hence a more likely target for attack.

Re: I use zip bombs to protect my server

#346

Post by ozim »

sunaookami wrote: post #76
ianlevesque wrote: post #73

Earlier quoted context omitted.

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.

I have better things to do with my time so I happily pay someone else to host it for me.

Re: I use zip bombs to protect my server

#347

Post by carlosjobim »

dmje wrote: post #280
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Just not true, although entirely aligned with HN users who often believe that the levels of nerdery on HN are common in the real world. WP isn’t bad, you’ve just done it wrong, and there really isn’t a better alternative for hundreds and hundreds of use cases..

My perspective is that WordPress is too complicated and too nerdy for most real world users. They are usually better off with a solution that is tailor made for their use case. And there's plenty of such solutions. Even for blogging, there are much better solutions than WordPress for non-technical users.

Re: I use zip bombs to protect my server

#348

Post by anthk »

jeroenhd wrote: post #113

These days, almost all browsers accept zstd and brotli, so these bombs can be even more effective today! [This]( https://news.ycombinator.com/item?id=23496794 ) old comment showed an impressive 1.2M:1 compression ratio and [zstd seems to be doing even better]( https://github.com/netty/netty/issues/14004 ). Though, bots may not support modern compression standards. Then again, that may be a good way to block bots: eve…

gzip it's everywhere and it will mess with every crawler.

Re: I use zip bombs to protect my server

#350

Post by carlosjobim »

nophunphil wrote: post #190
carlosjobim wrote: post #108

Earlier quoted context omitted.

By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of…

jQuery hasn’t been necessary for many years. Vanilla JS equivalents of jQuery code are well-supported. https://youmightnotneedjquery.com/

I've seen this site linked for many years among web devs, but I just don't understand the purpose? jQuery code is much cleaner and easier to understand, and there's a great amount of solutions written for jQuery available online for almost any need you have.
Post reply on HN