Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

381–390 of 467 posts

Re: I use zip bombs to protect my server

#381

Post by extraduder_ire »

msm_ wrote: post #164
ugurs wrote: post #129

Earlier quoted context omitted.

It requires at leadt few bytes, there is no way to represent 10GB of data in 8 bits.

But of course there is. Imagine the following compression scheme: 0-253: output the input byte 254 followed by 0: output 254 254 followed by 1: output 255 255: output 10GB of zeroes Of course this is an artificial example, but theoretically it's perfectly sound. In fact, I think you could get there with static huffman trees supported by some formats, including gzip.

> 254 followed by 0: output 254

126, surely?

Re: I use zip bombs to protect my server

#382

Post by kqr »

lazide wrote: post #338
GTP wrote: post #323

Earlier quoted context omitted.

I second this: depending on the context, there might be a more graceful way of handling a response that's too long then crashing the process.

Though the issue with ‘too many byte’ limits is that this tends to cause outages later then time has passed and now whatever the common size was is now ‘tiny’, like if you’re dealing with images, etc. Time limits tend to also defacto limit size, if bandwidth is somewhat constrained.

Deliberately denying service in one user flow because technology has evolved is much better than accidentally denying service to everyone because some part of the system misbehaved.

Timeouts and size limits are trivial to update as legitimate need is discovered.

Re: I use zip bombs to protect my server

#383

Post by keitmo »

kqr wrote: post #240
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

The lesson for any programmers reading this is to always set an upper limit for how much data you accept from someone else. Every request should have both a timeout and a limit on the amounts of data it will consume.

As a former boss used to say: "Unlimited is a bad idea."

Re: I use zip bombs to protect my server

#385

Post by close04 »

GTP wrote: post #337
close04 wrote: post #306

Earlier quoted context omitted.

How strange, took at least 30s to load on my iPhone 12 Pro Max with Safari but it was smooth to pan and zoom after. Which is way better than my 16 core 64GB RAM Windows machine where both Chrome and Edge gave up very quickly, with a "broken thumbnail" icon.

Probably because they're based on the same engine.

The strangeness was that 2 iPhones from the same generation would exhibit such different performance behaviors, and in parallel the irony that a desktop browser (engine irrelevant) on a device with cutting edge performance can't do what a phone does.

Re: I use zip bombs to protect my server

#386

Post by toast0 »

cratermoon wrote: post #372
toast0 wrote: post #24

Earlier quoted context omitted.

If it's easy, sleep 30 before returning 429. Or tcpdrop the connections and don't even send a response or a tcp reset.

That's a good way to self-DOS

That's why I said, if it's easy. On some server stacks it's no big deal to have a connection open for an extra 30 seconds; others, you need to be done with requests asap, even abuse.

tcpdrop shouldn't self DOS though, it's using less resources. Even if other end does a retry, it will do it after a timeout; in the meantime, the other end has a socket state and you don't, that's a win.

Re: I use zip bombs to protect my server

#387

Post by pixxel »

1oooqooq wrote: post #362
djxfade wrote: post #142

Earlier quoted context omitted.

Statamic https://statamic.com/

weird "license" on that project. pretty much blocks any self host usage besides a personal blog. And only hosted option for the copyrighted code starts at 300/y these don't cover any use case people use WordPress for.

[dead]

Re: I use zip bombs to protect my server

#388

Post by dspillett »

nottorp wrote: post #276

But what about the bots written in Rust? Will that get rid of them too?

Rust born processes are memory-safe in terms of avoiding corruption of their heaps & stacks by C-like problems like rogue pointers and use-after-free, but they are still subject to OOM conditions, or running out of other storage, so can easily be killed by a zip-bomb if not coded in an appropriately defensive manner.

Re: I use zip bombs to protect my server

#389

Post by seqizz »

echoangle wrote: post #373
seqizz wrote: post #367

Earlier quoted context omitted.

I'm also not a lawyer, but wouldn't they dismiss this as a sabotage if the requester is not legally forced to request it in the first place?

No, why would they? If I voluntarily request your website, you can’t just reply with a virus that wipes my harddrive. Even though I had the option to not send the request. I didn’t know that you were going to sabotage me before I made the request.

Because you requested it? There is no agreement on what or how to serve things, other than standards (your browser expects a valid document on the other side etc).

I just assumed court might say there is a difference between you requesting all guess-able endpoints and find 1 endpoint which will harm your computer (while there was _zero_ reason for you to access that page) and someone putting zipbomb into index.html to intentionally harm everyone.

Re: I use zip bombs to protect my server

#390

Post by a_gopher »

grishka wrote: post #184
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captch…

apart from blind users, who are also now completely unable to use their screenreaders with your site
Post reply on HN