Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

361–370 of 467 posts

Re: I use zip bombs to protect my server

#361

Post by zerr »

seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

Didn't get why that WinNT box was connecting to your box. Due to some misconfigured Windows update procedure?

Re: I use zip bombs to protect my server

#362

Post by 1oooqooq »

djxfade wrote: post #142
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Statamic https://statamic.com/

weird "license" on that project. pretty much blocks any self host usage besides a personal blog.

And only hosted option for the copyrighted code starts at 300/y

these don't cover any use case people use WordPress for.

Re: I use zip bombs to protect my server

#365

Post by Meneth »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

On my Waterfox 6.5.6, it opened but remained blurry when zoomed in. MS Paint refused to open it. The GIMP v2.99.18 crashed and took my display driver with it. Windows 10 Photo Viewer surprisingly managed to open it and keep it sharp when zoomed in. The GIMP v3.0.2 (latest version at the time of writing) crashed.

Re: I use zip bombs to protect my server

#366

Post by zparky »

immibis wrote: post #289
vitus wrote: post #197

Earlier quoted context omitted.

> There's literally no machine on Earth today that can deal with that (as a single file, I mean). Oh? Certainly not in RAM, but 4 PiB is about 125x 36TiB drives (or 188x 24TiB drives). (You can go bigger if you want to shell out tens of thousands per 100TB SSD, at which point you "only" need 45 of those drives.) These are numbers such that a purpose-built server with enough SAS expanders could easily fit that within…

I think you can rent a server with about 4.5 PiB from OVH - as a standard product offering, not even a special request. It costs a lot, obviously.

I would hope if you request a 4.5 PiB allocation somebody somewhere tries to call you to ask if you didnt accidentally put a couple extra zeroes lol

Re: I use zip bombs to protect my server

#367

Post by seqizz »

echoangle wrote: post #304
boricj wrote: post #98

Earlier quoted context omitted.

> robots.txt isn’t really legally binding Neither is the HTTP specification. Nothing is stopping you from running a Gopher server on TCP port 80, should you get into trouble if it happens to crash a particular crawler? Making a HTTP request on a random server is like uttering a sentence to a random person in a city: some can be helpful, some may tell you to piss off and some might shank you. If you don't like the lat…

The law might stop you from sending specific responses if the only goal is to sabotage the requesting computer. I’m not 100% familiar with US law but I think intentionally sabotaging a computer system would be illegal.

I'm also not a lawyer, but wouldn't they dismiss this as a sabotage if the requester is not legally forced to request it in the first place?

Re: I use zip bombs to protect my server

#369

Post by jve »

sixtyj wrote: post #253
opan wrote: post #166

Earlier quoted context omitted.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

PDF files with included vector-based layers, e.g. plans or maps of large area, are also quite difficult to render/open.

Just today collegue was looking at some air traffic permit map within PDF that was like 12MB or something around that. Complained about Adobe Reader changing something so he cannot pan/zoom no more.

I suggested to try the HN beloved Sumatra PDF. Ugh, it couldn't cope with it normally. Chrome did it better coped better.

Re: I use zip bombs to protect my server

#370

Post by seethishat »

VladVladikoff wrote: post #364

IsMalicious() doing some real heavy lifting in that pseudo code. Would love to see a bit more under THAT hood.

It's probably watching for connections to files listed in robots.txt that should not be crawled, etc. Once a client tries to do that thing (which it was told not to do), then it gets tagged malicious and fed the zip file.
Post reply on HN