Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

391–400 of 467 posts

Re: I use zip bombs to protect my server

#391

Post by lazide »

kqr wrote: post #382
lazide wrote: post #338

Earlier quoted context omitted.

Though the issue with ‘too many byte’ limits is that this tends to cause outages later then time has passed and now whatever the common size was is now ‘tiny’, like if you’re dealing with images, etc. Time limits tend to also defacto limit size, if bandwidth is somewhat constrained.

Deliberately denying service in one user flow because technology has evolved is much better than accidentally denying service to everyone because some part of the system misbehaved. Timeouts and size limits are trivial to update as legitimate need is discovered.

Oh man, I wish I could share some outage postmortems with you.

Practically speaking, putting an arbitrary size limit somewhere is like putting yet-another-ssl-cert-that-needs-to-be-renewed in some critical system. It will eventually cause an outage you aren’t expecting.

Will there be a plausible someone to blame? Of course. Realistically, it was also inevitable someone would forget and run right into it.

Time limits tend to not have this issue, for various reasons.

Re: I use zip bombs to protect my server

#393

Post by dspillett »

thephyber wrote: post #81
echoangle wrote: post #68

Earlier quoted context omitted.

I’m not sure that’s enough, robots.txt isn’t really legally binding so if the zip bomb somehow would be illegal, guarding it behind a robots.txt rule probably wouldn’t make it fine.

Who, running a crawler which violates robots.txt, is going to prosecute/sue the server owner? The server owner can make an easy case to the jury that it is a booby trap to defend against trespassers.

> can make an easy case to the jury that it is a booby trap to defend against trespassers

I don't know of any online cases, but the law in many (most?) places certainly tends to look unfavourably on physical booby-traps. Even in the US states with full-on “stand your ground” legislation and the UK where common law allows for all “reasonable force” in self-defence, booby-traps are usually not considered self-defence or standing ground. Essentially if it can go off automatically rather than being actioned by a person in a defensive action, it isn't self-defence.

> Who […] is going to prosecute/sue the server owner?

Likely none of them. They might though take tit-for-tat action and pull that zipbomb repeatedly to eat your bandwidth, and they likely have more and much cheaper bandwidth than your little site. Best have some technical defences ready for that, as you aren't going to sue them either: they are probably running from a completely different legal jurisdiction and/or the attack will come from a botnet with little or no evidence trail wrt who kicked it off.

Re: I use zip bombs to protect my server

#394

Post by [deleted] »

lazide wrote: post #338
GTP wrote: post #323

Earlier quoted context omitted.

I second this: depending on the context, there might be a more graceful way of handling a response that's too long then crashing the process.

Though the issue with ‘too many byte’ limits is that this tends to cause outages later then time has passed and now whatever the common size was is now ‘tiny’, like if you’re dealing with images, etc. Time limits tend to also defacto limit size, if bandwidth is somewhat constrained.

[deleted]

Re: I use zip bombs to protect my server

#395

Post by GTP »

lazide wrote: post #391
kqr wrote: post #382

Earlier quoted context omitted.

Deliberately denying service in one user flow because technology has evolved is much better than accidentally denying service to everyone because some part of the system misbehaved. Timeouts and size limits are trivial to update as legitimate need is discovered.

Oh man, I wish I could share some outage postmortems with you. Practically speaking, putting an arbitrary size limit somewhere is like putting yet-another-ssl-cert-that-needs-to-be-renewed in some critical system. It will eventually cause an outage you aren’t expecting. Will there be a plausible someone to blame? Of course. Realistically, it was also inevitable someone would forget and run right into it. Time limits…

But not putting the limits, leaves the door open to a different class of outages in the form of buffer overflows, that additionally can also pose a security risk as could be exploitable by an attacker. maybe this issue would be better solved at the protocol level, but in the meantime size limit it is.

Re: I use zip bombs to protect my server

#396

Post by ge96 »

seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

tangent

I had a lazy fix for a down detection on my RPi server at home, it was pinging a domain I owned and if it couldn't hit that assumed it wasn't connected to a network/rebooted itself. I let the domain lapse and this RPi kept going down around 5 minutes... thought it was a power fault, then I remembered about that CRON job.

Re: I use zip bombs to protect my server

#397

Post by lazide »

GTP wrote: post #395
lazide wrote: post #391

Earlier quoted context omitted.

Oh man, I wish I could share some outage postmortems with you. Practically speaking, putting an arbitrary size limit somewhere is like putting yet-another-ssl-cert-that-needs-to-be-renewed in some critical system. It will eventually cause an outage you aren’t expecting. Will there be a plausible someone to blame? Of course. Realistically, it was also inevitable someone would forget and run right into it. Time limits…

But not putting the limits, leaves the door open to a different class of outages in the form of buffer overflows, that additionally can also pose a security risk as could be exploitable by an attacker. maybe this issue would be better solved at the protocol level, but in the meantime size limit it is.

Nah, just OOM. Yes, there does need to be a limit somewhere - it just doesn’t need to be arbitrary, but based on some processing limit, and ideally will adapt as say memory footprint gets larger.

Re: I use zip bombs to protect my server

#400

Post by Dwedit »

GTP wrote: post #342
amelius wrote: post #311

Earlier quoted context omitted.

Maybe it's time for a /dev/zipbomb device.

ln -s /dev/urandom /dev/zipbomb && echo 'Boom!' Ok, not a real zip bomb, for that we would need a kernel module.

That costs you a lot of bandwidth, defeating the whole point of a zip bomb.
Post reply on HN