291–300 of 467 posts
I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.
Earlier quoted context omitted.
Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…
I don't believe the client counts as a protected computer because they initiated the connection. Also a protected computer is a very specific definition that involves banking and/or commerce and/or the government.
In particular, the interstate commerce clause is very over-reaching. It's been ruled that someone who grew their own crops to feed to their own farm animals sold locally was conducting interstate commerce because they didn't have to buy them from another state.
Earlier quoted context omitted.
Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…
We have a (internally accessible only) WP instance where the content is exported using a plugin as a ZIP file and then deployed to NGINX servers with a bit of scripting/Ansible. Could be automated better (drop ZIP to a share somewhere where it gets processed and deployed) but best of both worlds.
This topic comes up from time to time and I'm surprised no one yet mentioned the usual fearmongering rhetoric of zip bombs being potentially illegal. I'm not a lawyer, but I'm yet to see a real life court case of a bot owner suing a company or an individual for responding to his malicious request with a zip bomb. The usual spiel goes like this: responding to his malicious request with a malicious response makes you a…
Anyone can sue anyone else for any reason. This is what trips me up: >On my server, I've added a middleware that checks if the current request is malicious or not. There's a lot of trust placed in: >if (ipIsBlackListed() || isMalicious()) { Can someone assigned a previously blacklisted IP or someone who uses a tool to archive the website that mimics a bot be served malware? Is the middleware good enough or "good enou…
A user has to manually unpack a zip bomb, though. They have to open the file and see "uncompressed size: 999999999999999999999999999" and still try to uncompress it, at which point it's their fault when it fills up their drive and fails. So I don't think there's any ethical dilemma there.
Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?
Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…
Earlier quoted context omitted.
I wonder if I could create a 500TB html file with proper headers on a squashfs, an endless ... with no closing tags, and if I could instruct the server to not report file size before download. Any ideeas?
Yes, servers can respond without specifying the size by using chunked encoding. And you can do the rest with a custom web server that just handles request by returning " " in a loop. I have no idea if browsers are vulnerable to such a thing.
Earlier quoted context omitted.
Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…
We have a (internally accessible only) WP instance where the content is exported using a plugin as a ZIP file and then deployed to NGINX servers with a bit of scripting/Ansible. Could be automated better (drop ZIP to a share somewhere where it gets processed and deployed) but best of both worlds.
Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.
I am not sure how that could’ve worked. Unless the real /dev tree was exposed to your webserver’s chroot environment, this would’ve given nothing special except “file not found”.
The whole point of chroot for a webserver was to shield clients from accessing special files like that!
10T is probably overkill though.