A better zip bomb • Hacker News Board

Re: A better zip bomb

#81

Post by jedimastert » Thu, Jul 04, 2019, 3:54 PM UTC

the8472 wrote: post #65

Waterluvian wrote: post #58

Are you able to theoretically look at compressed data without size Metadata and estimate its final size without actually uncompressing it?

At worst you can just run the decompression algorithm while piping the output into the void, only counting the length. If you want to be slightly more efficient you can probably write an optimized stream parser for the compressor's format and sum up the lengths of dictionary/literals/back-references while skipping any other processing, but that depends on how amenable to fast-forwarding the stream format is. If the g…

I was thinking that you could just go through the process without writing anywhere, and show a growing "estimate". I feel like if you can get a size of each kernel and follow the instructions you could do so much faster, but I don't know enough about the in's and out of the DEFLATE algorithm and the edge cases.

Re: A better zip bomb

#82

Post by d33 » Thu, Jul 04, 2019, 4:07 PM UTC

Surprised nobody commented on this before:

> A final plea

> It's time to put an end to Facebook. Working there is not ethically neutral: every day that you go into work, you are doing something wrong. If you have a Facebook account, delete it. If you work at Facebook, quit.

> And let us not forget that the National Security Agency must be destroyed.

Personally I do agree. By the way, I got to meet the author (David Fifield) in person. An extremely bright mind!

Re: A better zip bomb

#83

Post by bluedino » Thu, Jul 04, 2019, 4:08 PM UTC

Gmail detects this as an unsafe file.

Re: A better zip bomb

#84

Post by IronBacon » Thu, Jul 04, 2019, 4:18 PM UTC

luckylion wrote: post #63

IronBacon wrote: post #49

Earlier quoted context omitted.

I put, as a test and for fun, a "Disallow" entry in my robots.txt (with a campy name to be honest) and not a single crawler hit that dir in more than three years, don't know if others had the same experience.

I was suggesting Disallow to make sure Google doesn't request it ;) I don't know if any bots look at robots.txt to see potentially interesting URLs. I do when I take a better look at sites, but I usually don't qualify as a bot. My experience is that most bots just hit the usual suspects, /wp-login.php, /phpmyadmin/ etc, regardless whether they are in robots.txt or not.

> My experience is that most bots just hit the usual suspects, /wp-login.php, /phpmyadmin/ etc, regardless whether they are in robots.txt or not.

Yeah, basically what I see in my logs. To be more clear, the disallow is for a non existent path in the document dir. I somewhat expected to find at least one script to actively crawl it, but it makes sense, as no sane people would put secrets on a website and protect them with a robot.txt... ^__^;

Re: A better zip bomb

#85

Post by ddebernardy » Thu, Jul 04, 2019, 4:19 PM UTC

jalk wrote: post #60

ddebernardy wrote: post #41

Earlier quoted context omitted.

You don't. Though to Apple's credit, users who are concerned with verifying checksums probably overlap with those that take cursory steps to harden their browser by, among various steps, disallowing Safari to open "safe" documents (that's what they're called in Safari's option).

Would it be prejudice to think that the checksum verifying users are not using safari?

Might be, I've no idea. Anecdotally I use Safari - faster, I prefer the UI, and I don't trust Chrome.

The only reason I've Chrome around is for the growing number of sites that only work with Chrome. Apps made by Google, in particular, increasingly don't support macOS/Safari. Which I find infuriating, but that's another topic.

Re: A better zip bomb

#86

Post by vasili111 » Thu, Jul 04, 2019, 4:21 PM UTC

gdy wrote: post #78

teddyh wrote: post #70

Earlier quoted context omitted.

I always preferred ARJ; I remember it having both better compression and more useful options than ZIP.

And later came RAR

And now 7z.

Re: A better zip bomb

#87

Post by chrisstanchak » Thu, Jul 04, 2019, 4:28 PM UTC

ttul wrote: post #68

I remember being so excited when the zip format came out. Prior to zip, we suffered with the arc format. At 2400 baud, the difference in compression was very very significant.

Yea but when you got on a bbs that supported zmodem transfers...

Re: A better zip bomb

#88

Post by nothrabannosir » Thu, Jul 04, 2019, 4:31 PM UTC

derefr wrote: post #77

bestham wrote: post #29

Earlier quoted context omitted.

How can you for instance verify the checksum of the file when it's deleted?

It should be noted, when Safari deletes an extracted archive, it isn’t deleting it; it’s putting the archive in the Trash. You can just turn around and fish it back out. That’s one of the Trash’s roles in macOS: to serve as a place for the OS to put things that you probably don’t want, “but if you do, here’s an opportunity to grab them before they’re gone.” (I’m honestly surprised that every time you Cmd+C, the previ…

> I’m honestly surprised that every time you Cmd+C, the previous contents of the clipboard don’t end up as a file in the Trash.

Purely my hypothesis: it’s too high a risk that someone accidentally leaves a password or private info in their clipboard. People don’t expect a clipboard to persist, so you’d need to re-educate everyone to avoid this “bug”, just like browser history and incognito mode.

Apple is notorious for assimilating popular third party extensions. Screencapture, night shift, colour picker , why no stack based clipboard? It’s too useful to have been overlooked. Must have been a conscious decision.

Re: A better zip bomb

#89

Post by platz » Thu, Jul 04, 2019, 4:35 PM UTC

d33 wrote: post #82

Surprised nobody commented on this before: > A final plea > It's time to put an end to Facebook. Working there is not ethically neutral: every day that you go into work, you are doing something wrong. If you have a Facebook account, delete it. If you work at Facebook, quit. > And let us not forget that the National Security Agency must be destroyed. Personally I do agree. By the way, I got to meet the author (David F…

Disband the military as well?

Open the borders?

Decommission the nukes?

Break up the banks?

Get rid of the filibuster?

Re: A better zip bomb

#90

Post by ttul » Thu, Jul 04, 2019, 4:53 PM UTC

teddyh wrote: post #70

ttul wrote: post #68

I remember being so excited when the zip format came out. Prior to zip, we suffered with the arc format. At 2400 baud, the difference in compression was very very significant.

I always preferred ARJ; I remember it having both better compression and more useful options than ZIP.

ARJ came after ZIP. Us poor eighties kids had to suffer with ARC.