Live data from Hacker News

Zip Bomb

en.wikipedia.org

101–110 of 113 posts

Re: Zip Bomb

#101

Earlier quoted context omitted.

That was how RSA was breached, which led to the eventual loss of the SecureID master key (and follow-on breeches at DoD suppliers).

What does RSA stand for? I was on their (SecurID) related site, and checked out the "about" page, but the acronym is never defined.

Initials of the three inventors (discoverers?) of the algorithm: http://en.wikipedia.org/wiki/RSA_(algorithm)

Re: Zip Bomb

#102

Earlier quoted context omitted.

That was how RSA was breached, which led to the eventual loss of the SecureID master key (and follow-on breeches at DoD suppliers).

What does RSA stand for? I was on their (SecurID) related site, and checked out the "about" page, but the acronym is never defined.

(Ron) Rivest, (Adi) Shamir, (Leonard) Adleman

Re: Zip Bomb

#103
post #94

Earlier quoted context omitted.

That reminds me of an incident when I was in year 8: seeing how deeply nested I could get directories on Windows. H:\a\a\a\a\..., eventually it stopped working. (I played the game with my friend... he went for creating a new directory at each level, after a little I became sensible and went for copying and pasting, thus multiplying the depth by two each level which of course achieves the goal pretty quickly - so I wo…

The NTFS 256-character-path bit me before when I moved a deeply-nested folder from somewhere with a short path (like the root of a disk) to somewhere with a slightly longer one (like my desktop) and then went to delete it. Windows doesn't even complain in this case--it just completely ignores all attempt to delete the folder (even if you, say, put it in the trash and then empty the trash) because it can't complete th…

Had this problem once as well. It's so weird that explorer doesn't use the API without the path length restriction...

Re: Zip Bomb

#104
post #72

Earlier quoted context omitted.

That reminds me of an incident when I was in year 8: seeing how deeply nested I could get directories on Windows. H:\a\a\a\a\..., eventually it stopped working. (I played the game with my friend... he went for creating a new directory at each level, after a little I became sensible and went for copying and pasting, thus multiplying the depth by two each level which of course achieves the goal pretty quickly - so I wo…

My brother did this exact same thing (competing with his friend to try to make as many folders as possible), only he got a 1 week suspension for "hacking". The IT manager was really pissed and pressed the school administrators to make an example out of them. I was outraged. Basically, the IT manager preferred to use punishment as his means of security, rather than actually doing his job.

Being able to break something =/= IT not doing their job.

Tossing a brick through a window doesn't mean that the window should have been thicker.

Re: Zip Bomb

#106
post #91

I found a similar file to this (a zip file that contains itself) and e-mailed it to a friend at work. He never received it, but I thought nothing of it (I assumed the email filters just destroyed it). A days later the mail server stops working and the sysadmin turns up at my desk. Turns out the anti-virus scanner had been unzipping and scanning repeatedly. It eventually filled up the entire disk and bad things happen…

That's hilarious -- the viros scanner, which is designed to protect the mail server, was what wound up destroying it in the first place.

The virus scanner is designed to protect the mail server's clients.

Re: Zip Bomb

#108
post #80

Earlier quoted context omitted.

While MAX_PATH is 260, most of the Unicode variants of the API functions allow for paths of 32,767 characters [1]. That seems like a decent length. [1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa36...

Oh, that's somewhat reassuring. I'll surely benefit from it in 10 years time. :/

I'm not sure that I know what you mean. These functions aren't obscure and have been around for quite a while. For example: CreateFileW [1]. It's just good hygiene to use the Unicode variants and normalize to UNC where appropriate. This has been the case for years.

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa36...

Re: Zip Bomb

#109
post #108

Earlier quoted context omitted.

Oh, that's somewhat reassuring. I'll surely benefit from it in 10 years time. :/

I'm not sure that I know what you mean. These functions aren't obscure and have been around for quite a while. For example: CreateFileW [1]. It's just good hygiene to use the Unicode variants and normalize to UNC where appropriate. This has been the case for years. [1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa36...

I mean that to maintain compatibility with legacy stuff I expect I won't be able to take advantage of it for quite a while.

Re: Zip Bomb

#110
post #72

Earlier quoted context omitted.

My brother did this exact same thing (competing with his friend to try to make as many folders as possible), only he got a 1 week suspension for "hacking". The IT manager was really pissed and pressed the school administrators to make an example out of them. I was outraged. Basically, the IT manager preferred to use punishment as his means of security, rather than actually doing his job.

Being able to break something =/= IT not doing their job. Tossing a brick through a window doesn't mean that the window should have been thicker.

Except that this was not 'tossing a brick,' it was maybe knocking on a window to see what sound it makes, and the window then falling apart for no apparent reason.

There is nobody to blame for this, actually. Neither could the kid have known that this was bad (and the child-like curiosity is hardly something worth a punishment,) nor could the sysadmin really do anything to prevent it, except hang up a memo: please don't do that.

Though, in that case, you'd have some kids doing that over and over again out of a very different kind of curiosity.

Post reply on HN