Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

251–260 of 467 posts

Re: I use zip bombs to protect my server

#251

Post by eru »

ufmace wrote: post #224
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

I find it very telling that there's no 2 responses to this post recommending the same thing. Confirms my belief that there is no real alternative to Wordpress for a free and open-source CMS that is straightforward to install and usable to build and edit pages by non-tech-experts.

Perhaps people who wanted to recommend the same thing as was already written, just upvoted instead of writing their own comment?

Re: I use zip bombs to protect my server

#253

Post by sixtyj »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

PDF files with included vector-based layers, e.g. plans or maps of large area, are also quite difficult to render/open.

Re: I use zip bombs to protect my server

#254

Post by connicpu »

lgeek wrote: post #205
opan wrote: post #166

Earlier quoted context omitted.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

On Firefox on Android on my pretty old phone, a blurry preview rendered in about 10 seconds, and it was fully rendered in 20 something seconds. Smooth panning and zooming the entire time

Firefox on a Samsung S23 Ultra did it a few seconds faster but otherwise the same experience

Re: I use zip bombs to protect my server

#255

Post by koiueo »

socalgal2 wrote: post #111
willyt wrote: post #94

Earlier quoted context omitted.

Static site with Jekyll?

Jekyll and other static site generators do not repo Wordpress any more than notepad repos MSWord In one, multiple users can login, edit WYSIWYG, preview, add images, etc, all from one UI. You can access it from any browser including smart phones and tablets. In the other, you get to instruct users on git, how to deal with merge conflicts, code review (two people can't easily work on a post like they can in wordpress)…

Have you checked static site CMSes?

For example (not affiliated with them) https://www.siteleaf.com/

Re: I use zip bombs to protect my server

#256

Post by eru »

kam wrote: post #147
kulahan wrote: post #125

Earlier quoted context omitted.

Isn’t this basically a question about the halting problem? Whatever arbitrary cutoff you chose might not work for all.

No, compression formats are not Turing-complete. You control the code interpreting the compressed stream and allocating the memory, writing the output, etc. based on what it sees there and can simply choose to return an error after writing N bytes.

Yes, and even if they were Turing complete, you could still run your Turing-machine-equivalent for n steps only before bailing.

Re: I use zip bombs to protect my server

#257

Post by eru »

suid wrote: post #182
fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

Good question. The "ultimate zip bomb" looks something like https://github.com/iamtraction/ZOD - this produces the infamous "42.zip" file, which is about 42KiB, but expands to 3.99 PiB (!). There's literally no machine on Earth today that can deal with that (as a single file, I mean).

That's far from the ultimate zip bomb.

42.zip has five layers. But you can make a zip file that has an infinite number of layers. See https://research.swtch.com/zip or https://alf.nu/ZipQuine

Re: I use zip bombs to protect my server

#258

Post by eru »

rtkwe wrote: post #211
malfist wrote: post #163

Earlier quoted context omitted.

I mean, if I make a new compression algorithm that says a 10GB file of zeros is represented with a single specific byte, that would technically be compression. All depends on how much magic you want to shove into an "algorithm"

If it's not standard I count the extra program required to decompress it as part of the archive.

Yes, though in this case that wouldn't add much.

Re: I use zip bombs to protect my server

#259

Post by eru »

jedberg wrote: post #231
thayne wrote: post #155

Earlier quoted context omitted.

Part B of the definition of "protected computer" says: > which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Assuming the server is running in the states, I think that would apply unless the client is in the same state as the serve…

The word "accessed" is used multiple times throughout the law. A client accesses a server. A server does not access a client. It responds to a client. Also, the protected computer has to be involved in commerce. Unless they are accessing the website with the zip bomb using a computer that also is uses for interstate or foreign commerce, it won't qualify.

> Also, the protected computer has to be involved in commerce.

In the US, virtually everything is involved in 'interstate commerce'. See https://en.wikipedia.org/wiki/Commerce_Clause

> The Commerce Clause is the source of federal drug prohibition laws under the Controlled Substances Act. In a 2005 medical marijuana case, Gonzales v. Raich, the U.S. Supreme Court rejected the argument that the ban on growing medical marijuana for personal use exceeded the powers of Congress under the Commerce Clause. Even if no goods were sold or transported across state lines, the Court found that there could be an indirect effect on interstate commerce and relied heavily on a New Deal case, Wickard v. Filburn, which held that the government may regulate personal cultivation and consumption of crops because the aggregate effect of individual consumption could have an indirect effect on interstate commerce.

Re: I use zip bombs to protect my server

#260

Post by eru »

klabb3 wrote: post #222
jawns wrote: post #54

Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?

Just crossed my mind that perhaps lots of bot traffic is coming from botnets of unaware victims who downloaded a shitty game or similar, orchestrated by a malicious C&C server somewhere else. (There was a post about this type of malware recently.) Now, if you crash the victims machine, it’s complicated at least ethically, if not legally.

Though ethically it might be a good thing to shut down their infected computer, instead of keeping it running.
Post reply on HN