News for hackers. Stuff that matters.
Re:Defending a website with Zip bombs by Filligree on Thursday July 06, 2017 @07:10AM (#14709483)
One useful trick is that, for gzip, d(z(x+y)) = d(z(x) + z(y)).

So you don't need to compress the entire terabyte.

Re:Defending a website with Zip bombs by masklinn on Thursday July 06, 2017 @07:57AM (#14709669)
I'd expect that to provide a lower compression, though it may not matter given the additional followup gzips.

The compression finally finished after 3h (on an old MBP), "dd if=/dev/zero bs=1m count=1m | gzip | gzip | gzip" yields a bit under 10k (10082 bytes), and adding a 4th gzip yields a bit under 4k (4004 bytes). The 5th gzip starts increasing the size of the archive.

Re:Defending a website with Zip bombs by Filligree on Thursday July 06, 2017 @08:06PM (#14714978)
It does, though I once used that trick to create a file containing more "Hello, World" lines than there are atoms in the universe. By, hmm, quite a large factor. It probably isn't a serious concern.

It still fit on a floppy disk. :)

Re:Defending a website with Zip bombs by colanderman on Thursday July 06, 2017 @09:47AM (#14710345)
That's true for the content stream but not gzip files themselves, which do have a minimal header.
Re:Defending a website with Zip bombs by Filligree on Tuesday July 11, 2017 @04:54PM (#14747967)
Which gunzip will overlook / handle correctly, so concatenating the compressed files does work.