Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

331–340 of 467 posts

Re: I use zip bombs to protect my server

#331

Post by jabl »

3np wrote: post #48
jerf wrote: post #39

Earlier quoted context omitted.

You want to consider the ratio of your resource consumption to their resource consumption. If you trickle bytes from /dev/random, you are holding open a TCP connection with some minimal overhead, and that's about what they are doing too. Let's assume they are bright enough to use any of the many modern languages or frameworks that can easily handle 10K/100K connections or more on a modern system. They aren't all that…

Also might open up a new DoS vector on entropy consumed by /dev/random so it can be worse than 1:1.

As mentioned, not really an issue on a modern system. But in any case, you could just read, say, 1K from /dev/urandom into a buffer and then keep resending that buffer over and over again?

Re: I use zip bombs to protect my server

#332

Post by dspillett »

As an aside, there are a lot of people out there standing up massive microservice implementations¹ for relatively small sites/apps, which need to have this part printed, wrapped around a brick, and lobbed at their heads:

> A well-optimized, lightweight setup beats expensive infrastructure. With proper caching, a $6/month server can withstand tens of thousands of hits — no need for Kubernetes.

----

[1] Though doing this in order to play/learn/practise is, of course, understandable.

Re: I use zip bombs to protect my server

#333

Post by lillecarl »

malfist wrote: post #162
lillecarl wrote: post #103

Earlier quoted context omitted.

Manual banning is about the same since you just book /56 or bigger, entire providers or countries. Automated banning is harder, you'd probably want a heuristic system and look up info on IPs. IPv4 with NAT means you can "overban" too.

Why wouldn't something like fail2ban not work here? That's what it's built for and has been around for eons.

You don't always firewall 80/443 in Linux :(

Re: I use zip bombs to protect my server

#334

Post by msh »

willyt wrote: post #94
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Static site with Jekyll?

Its sad software like citydesk died and did not evolve into multiuser applications.

Re: I use zip bombs to protect my server

#336

Post by avianlyric »

Moosdijk wrote: post #217
opan wrote: post #166

Earlier quoted context omitted.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

It loads in about 5 seconds on an iPhone 12 using safari. It also pans and zooms swiftly

Same, right up until I zoomed in and waited for Safari to produce a higher resolution render.

Partially zoomed in was fine, but zooming to maximum fidelity resulted in the tab crashing (it was completely responsive until the crash). Looks like Safari does some pretty smart progressive rendering, but forcing it to render the image at full resolution (by zooming in) causes the render to get OOMed or similar.

Re: I use zip bombs to protect my server

#337

Post by GTP »

close04 wrote: post #306
Moosdijk wrote: post #217

Earlier quoted context omitted.

It loads in about 5 seconds on an iPhone 12 using safari. It also pans and zooms swiftly

How strange, took at least 30s to load on my iPhone 12 Pro Max with Safari but it was smooth to pan and zoom after. Which is way better than my 16 core 64GB RAM Windows machine where both Chrome and Edge gave up very quickly, with a "broken thumbnail" icon.

Probably because they're based on the same engine.

Re: I use zip bombs to protect my server

#338

Post by lazide »

GTP wrote: post #323
kqr wrote: post #268

Earlier quoted context omitted.

While that is true, I recommend on the request anyway, because it makes it abundantly clear to the programmer that requests can fail, and failure needs to be handled somehow – even if it's by killing and restarting the process.

I second this: depending on the context, there might be a more graceful way of handling a response that's too long then crashing the process.

Though the issue with ‘too many byte’ limits is that this tends to cause outages later then time has passed and now whatever the common size was is now ‘tiny’, like if you’re dealing with images, etc.

Time limits tend to also defacto limit size, if bandwidth is somewhat constrained.

Re: I use zip bombs to protect my server

#339

Post by MrDOS »

donnachangstein wrote: post #93
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

> Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Someh…

For those on macOS, RapidWeaver still exists: https://www.realmacsoftware.com/rapidweaver/. (Shame that it's now subscriptionware, though – could've sworn it used to be an outright purchase per major version.)

Re: I use zip bombs to protect my server

#340

Post by marcusb »

j16sdiz wrote: post #203
marcusb wrote: post #116

Earlier quoted context omitted.

Undoubtedly. If you go poking around most any security product (the product I was referring to was not in the EDR space,) you'll see these sorts of issues all over the place.

It have to be the way it is. Scanning them are resources intensive. The choice are (1) skip scanning them; (2) treat them as malware; (3) scan them and be DoS'ed. (deferring the decision to human iss effectively DoS'ing your IT support team)

It does not have to be the way it is. Security vendors could do a much better job testing and red teaming their products to avoid bypasses, and have more sensible defaults.
Post reply on HN