Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

411–420 of 467 posts

Re: I use zip bombs to protect my server

#411

Post by mjmsmith »

seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

Around the same time, or maybe even earlier, some random company sent me a junk fax every Friday. Multiple polite voicemails to their office number were ignored, so I made a 100-page PDF where every page was a large black rectangle, and used one of the new-fangled email-to-fax gateways to send it to them. Within the hour, I got an irate call. The faxes stopped.

Re: I use zip bombs to protect my server

#412

Post by vidarh »

pandemic_region wrote: post #345
vidarh wrote: post #318

Earlier quoted context omitted.

You yourself explain how it could've worked: Plenty of webservers are or were not chroot'ed.

Which means that if your bot is getting slammed by this, you can assume it's not chrooted and hence a more likely target for attack.

This does not logically follow. If your bot is getting slammed by a page returning all zeros (what the person I replied to reacted to), all you know is something on the server is returning a neverending stream of zeros. A symlink to /dev/zero is an easy way of doing that, but knowing the server is serving up a neverending stream of zeros by no means tells you whether the server is running in a decently isolated environment or not.

Even if you knew it was done with a symlink you don't know that - these days odds are it'd run in a container or vm, and so having access to /dev/zero means very little.

Re: I use zip bombs to protect my server

#413

Post by onethumb »

b2ccb2 wrote: post #404
JodieBenitez wrote: post #300

The same, for Caddy: https://www.dustri.org/b/serving-a-gzip-bomb-with-caddy.html 10T is probably overkill though.

Hilarious because the author, and the OP author, are literally zipping `/dev/null`. While they realize that it "doesn't take disk space nor ram", I feel like the coin didn't drop for them. Think about it: $ dd if=/dev/zero bs=1 count=10M | gzip -9 > 10M.gzip $ ls -sh 10M.gzip 12K 10M.gzip Other than that, why serve gzip anyway? I would not set the Content-Length Header and throttle the connection and set the MIME typ…

The whole point is for it to cost less (ie, smaller size) for the sender and cost more (ie, larger size) for the receiver.

The compression ratio is the whole point... if you can send something small for next to no $$ which causes the receiver to crash due to RAM, storage, compute, etc constraints, you win.

Re: I use zip bombs to protect my server

#414

Post by vinceguidry »

aaronbaugher wrote: post #89
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Wiki software is the way to go here.

Re: I use zip bombs to protect my server

#415

Post by danillonunes »

ge96 wrote: post #396
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

tangent I had a lazy fix for a down detection on my RPi server at home, it was pinging a domain I owned and if it couldn't hit that assumed it wasn't connected to a network/rebooted itself. I let the domain lapse and this RPi kept going down around 5 minutes... thought it was a power fault, then I remembered about that CRON job.

That's why everyone else is lazy and just ping google.com

Re: I use zip bombs to protect my server

#416

Post by mikaraento »

avianlyric wrote: post #336
Moosdijk wrote: post #217

Earlier quoted context omitted.

It loads in about 5 seconds on an iPhone 12 using safari. It also pans and zooms swiftly

Same, right up until I zoomed in and waited for Safari to produce a higher resolution render. Partially zoomed in was fine, but zooming to maximum fidelity resulted in the tab crashing (it was completely responsive until the crash). Looks like Safari does some pretty smart progressive rendering, but forcing it to render the image at full resolution (by zooming in) causes the render to get OOMed or similar.

I remember that years ago (mobile) Safari would aggressively use GPU layers and crash if you ran out of GPU memory. Maybe that's still happening?

Preview on a mac handles the file fine.

Re: I use zip bombs to protect my server

#418

Post by RulerOf »

lazide wrote: post #391
kqr wrote: post #382

Earlier quoted context omitted.

Deliberately denying service in one user flow because technology has evolved is much better than accidentally denying service to everyone because some part of the system misbehaved. Timeouts and size limits are trivial to update as legitimate need is discovered.

Oh man, I wish I could share some outage postmortems with you. Practically speaking, putting an arbitrary size limit somewhere is like putting yet-another-ssl-cert-that-needs-to-be-renewed in some critical system. It will eventually cause an outage you aren’t expecting. Will there be a plausible someone to blame? Of course. Realistically, it was also inevitable someone would forget and run right into it. Time limits…

> putting yet-another-ssl-cert-that-needs-to-be-renewed in some critical system

I found a fix for this some years back:

    openssl req -x509 -days 36500

Re: I use zip bombs to protect my server

#419

Post by mahi_novice »

foxfired wrote: post #83
mahi_novice wrote: post #61

Do you mind sharing your specs of your digital ocean droplet? I'm trying to setup one with less cost.

The blog runs on a $6 digital ocean droplet. It's 1GB RAM and 25GB storage. There is a link at the end of the article on how it handles typical HN traffic. Currently at 5% CPU.

Thanks for sharing!

Re: I use zip bombs to protect my server

#420

Post by BehindTheMath »

a_gopher wrote: post #390
grishka wrote: post #184

Earlier quoted context omitted.

> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captch…

apart from blind users, who are also now completely unable to use their screenreaders with your site

aria-hidden="true" should take care of that.
Post reply on HN