News for hackers. Stuff that matters.

A comment on Static analysis to prevent Zip Bombs and architectural bottlenecks.

Re:Static analysis to prevent Zip Bombs and architectural bo... by allenz_cheung on Wednesday December 03, 2025 @10:46PM (#46143591)
Hi HN, I'm working on CodeProt. We recently wrote about how we use static analysis (AST and data-flow) to catch performance killers like Zip Bombs and architectural bottlenecks (e.g., full DB reloads) early in the review process.

We found that performance isn't just about speed—it's about availability. A single unconstrained extraction or a bad architectural pattern can bring down a system just as effectively as a DDoS.

Curious to hear how others are automating these kinds of architectural checks.

[ Parent | on HN ]
Re:Static analysis to prevent Zip Bombs and architectural bo... by bediger4000 on Wednesday December 03, 2025 @11:04PM (#46143701)
Do you want spammers and scrapers to triumph!?! A zip bomb is a good way for the righteous to let it be known that unclean scrapers should stay away.
[ Parent | on HN ]
Re:Static analysis to prevent Zip Bombs and architectural bo... by theamk on Wednesday December 03, 2025 @11:27PM (#46143809)
Yes, they do. Remember, OP is build AI-powered review tools. Their technology won't exist without scrapers.
[ Parent | on HN ]
Re:Static analysis to prevent Zip Bombs and architectural bo... by tliltocatl on Thursday December 04, 2025 @03:56AM (#46145321)
It's not like they are not going to figure it out themselves eventually. Use inverse slow loris instead. Yes, these are harder to deploy, but much more robust.
[ Parent | on HN ]