[HN Gopher] A valid HTML zip bomb
___________________________________________________________________
A valid HTML zip bomb
Author : Bogdanp
Score : 109 points
Date : 2025-07-24 13:16 UTC (9 hours ago)
(HTM) web link (ache.one)
(TXT) w3m dump (ache.one)
| ranger_danger wrote:
| Did not crash Firefox nor Chrome for me on Linux.
| palmfacehn wrote:
| Try creating one with deeply nested tags. Recursively adding
| more nodes via scripting is another memory waster. From there
| you might consider additional changes to the CSS that cause the
| document to repaint.
| meinersbur wrote:
| It will also compress worse, making it less like a zip bomb
| and more like a huge document. Nothing against that, but the
| article's trick is just to stop a parser to bail early.
| palmfacehn wrote:
| For my usage, the compressed size difference with deeply
| nested divs was negligible.
| esperent wrote:
| It crashed the tab in Brave on Android for me.
| _ache_ wrote:
| Perhaps you have very generous limits on RAM allocation per
| thread. I have 32GB, 128 with swap and still crash (silently on
| Firefox and with a dedicated screen on Chrome).
| throwaway127482 wrote:
| Out of curiosity, how do you set these limits? I'm not the
| person you're replying to, but I'm just using the default
| limits that ship with Ubuntu 22.04
| _ache_ wrote:
| Usually in /etc/limits.conf. The field `as` for address
| space will be my guess, but I not sure, maybe `data`. The
| man page `man limits.conf` isn't very descriptive.
| inetknght wrote:
| > _The man page `man limits.conf` isn 't very
| descriptive._
|
| Looks to me like it's quite descriptive. What information
| do you think is missing?
|
| https://www.man7.org/linux/man-
| pages/man5/limits.conf.5.html
| johnisgood wrote:
| It crashed the tab on Vivaldi (Linux).
| andrew_eu wrote:
| I can imagine the large scale web scrapers just avoid processing
| comments entirely, so while they may unzip the bomb it could be
| they just discard the chunks that are inside of a comment. The
| same trick could be applied to other elements in the HTML though:
| semicolons in the style tag, some gigantic constant in inline JS,
| etc. If the HTML itself contained a gigantic tree of links to
| other zip bombs that could also have an amplifying effect on the
| bad scraper.
| _ache_ wrote:
| There is definitively improvements that can be made. The
| comment part is more about aesthetic as it is not needed
| actually, you could have just put the zip chunk in a `div`, I
| guess.
| ChrisArchitect wrote:
| Related:
|
| _Fun with gzip bombs and email clients_
|
| https://news.ycombinator.com/item?id=44651536
| cooprh wrote:
| Crashed 1password on safari haha
| chatmasta wrote:
| Note: the submission link is _not_ the zip bomb. It's safe to
| click.
| abirch wrote:
| Sounds like something a person linking to a zip bomb would say
| :-D
| bhaney wrote:
| Neat approach. I make my anti-crawler HTML zip bombs like this:
| (echo '<html><head></head><body>' && yes "<div>") | dd bs=1M
| count=10240 iflag=fullblock | gzip > bomb.html.gz
|
| So they're just billions of nested div tags. Compresses just as
| well as repeated-single-character bombs in my experience.
| _ache_ wrote:
| Nice command line.
| pyman wrote:
| This is a great idea.
|
| LLM crawlers are ignoring robots.txt, breaching site terms of
| service, and ingesting copyrighted data for training without a
| licence.
|
| We need more ideas like this!
| bhaney wrote:
| This is the same idea as in the article, just an alternative
| flavor of generating the zip bomb.
|
| And I actually only serve this to exploit scanners, not LLM
| crawlers.
|
| I've run a lot of websites for a long time, and I've never
| seen a legitimate LLM crawler ignore robots.txt. I've seen
| _reports_ of that, but any time I 've had a chance to look
| into it, it's been one of:
|
| - The site's robots.txt didn't actually say what the author
| thought they had made it say
|
| - The crawler had nothing to with the crawler it was claiming
| to be, it just hijacked a user agent to deflect blame
|
| It would be pretty weird, after all, for a company running a
| crawler to ignore robots.txt with hostile intent while also
| choosing to accurately ID itself to its victim.
| shakna wrote:
| Perplexity certainly was ignoring robots.txt [0]
|
| Anthropic... Their robots.txt requires a delay to be
| defined, even though its an optional extension. But
| whatever.
|
| [0] https://www.wired.com/story/perplexity-is-a-bullshit-
| machine...
| pyman wrote:
| There's plenty of evidence to the contrary;
|
| https://mjtsai.com/blog/2024/06/24/ai-companies-ignoring-
| rob...
| xd1936 wrote:
| Risky click
| Telemakhos wrote:
| Safari 18.5 (macOS) throws an error WebKitErrorDomain: 300.
| can16358p wrote:
| Crashing Safari on iOS (not technically crashing the whole app,
| but the tab displays internal WebKit error).
| Tepix wrote:
| Imagine you're a crawler operator. Do you really have a problem
| with documents like this? I don't think so.
| PeterStuer wrote:
| For every 1 robots.txt that is genuinly configured, there's 9
| that make absolutely no sense at all.
|
| Worse. GETing the robots.txt automatically flags you as a 'bot'!
|
| So as a crawler that wants to respect the spirit of the
| robots.txt, not the inane letter that your hired cheapest junior
| webadmin copy/pasted there from some reddit comment, we now have
| to jump through hoops such as geeting hhe robots.txt from a
| separate vpn etc.
| slig wrote:
| If you try to do that on a site with Cloudflare, what happens? Do
| they read the zip file and try to cache the uncompressed content
| to serve it with the best compression algorithm for a given
| client, or do they cache the compressed file and serve it "as
| is"?
| bhaney wrote:
| If you're doing this through cloudflare, you'll want to add the
| response header cache-control: no-transform
|
| so you don't bomb cloudflare when they naturally try to
| decompress your document, parse it, and recompress it with
| whatever methods the client prefers.
|
| That being said, you _can_ bomb cloudflare without significant
| issue. It 's probably a huge waste of resources for them, but
| they correctly handle it. I've never seen cloudflare give up
| before the end-client does.
| uxjw wrote:
| Cloudflare has free AI Labyrinths if your goal is to target AI.
| The bots follow hidden links to a maze of unrelated content,
| and Cloudflare uses this to identify bots.
| https://blog.cloudflare.com/ai-labyrinth/
___________________________________________________________________
(page generated 2025-07-24 23:01 UTC)