321–330 of 467 posts
Earlier quoted context omitted.
The lesson for any programmers reading this is to always set an upper limit for how much data you accept from someone else. Every request should have both a timeout and a limit on the amounts of data it will consume.
That doesn't necessarily need to be in the request itself. You can also limit the wider process or system your request is part of.
Earlier quoted context omitted.
I did essentially the same thing. I have this input in a form: Email: With this CSS: .nah { opacity: 0; position: absolute; top: 0; left: 0; height: 0; width: 0; z-index: -1; } And any form submission with a value set for the email is blocked. It stopped 100% of the spam I was getting.
Would this also stop users with automatic form filling enabled?
Earlier quoted context omitted.
That doesn't necessarily need to be in the request itself. You can also limit the wider process or system your request is part of.
While that is true, I recommend on the request anyway, because it makes it abundantly clear to the programmer that requests can fail, and failure needs to be handled somehow – even if it's by killing and restarting the process.
Earlier quoted context omitted.
Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…
DrupalCMS is a new project that aims to radically simplify for end users https://new.drupal.org/drupal-cms
> new
Pretty sure Drupal has been around for like, 20 years or so. Or is this a different Drupal?
Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.
I wonder if I could create a 500TB html file with proper headers on a squashfs, an endless ... with no closing tags, and if I could instruct the server to not report file size before download. Any ideeas?
yes ""|dd bs=1M count=10240 iflag=fullblock|gzip | pv > zipdiv.gz
Resulting file is about 15 mib long and uncompresses into a 10 gib monstrosity containing 1789569706 unclosed nested divs
Earlier quoted context omitted.
Do they comeback? If so then they detect it and avoid it. If not then they crashed and mission accomplished.
I currently cannot tell without making a little configuration change, because as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client. Secondly, I know that most of these bots do not come back. The attacks do not reuse addresses against the same server in order to evade almost any conceivable filter rule that is predicated on a pri…
> as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client.
Is this not why they aren’t getting the full file?
Earlier quoted context omitted.
There's no ethical ambiguity about serving garbage to malicious traffic. They made the request. Respond accordingly.
This is William Gibson's "black ICE" becoming real, and I love it. https://williamgibson.fandom.com/wiki/ICE
I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.
A compressed file that is only one byte long can only represent maximally 256 different uncompressed files. Signed, a kid in the 90s who downloaded some "wavelet compression" program from a BBS because it promised to compress all his WaReZ even more so he could then fit moar on his disk. He ran the compressor and hey golly that 500MB ISO fit into only 10MB of disk now! He found out later (after a defrag) that the "co…
Brings to mind this 30+ year old IOCCC entry for compressing C code by storing the code in the file names.
I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…
These links do show up for humans who might be using text browsers, (perhaps) screen readers, bookmarklets that list the links on a page, etc.