8 ms·

Abusing Your Browser: Infinitely Large Favicons

92 points by ejcx 11y ago

esailija 11y ago
"I believe in most other countries, that aren't the United States, people pay their internet usage by bandwidth used." that's... false
- awjr 11y ago
  Here in the UK, you can PAY to have unlimited and even that has abuse clauses.
  - Ntrails 11y ago
    My originial unlimited iPhone 3g connection had abuse clauses. Nobody cared when I used tethering to download 20gigs of steam games overnight - but if I was perma torrenting they might have done. The contractual limits give the company a legal out to deal with use that starts to impact other customers, they are not commonly enforced unless they are looking into a complaint to slow internet and your usage comes up as anomalous and potentially contributory (according to a friend at an ISP at least).
    - underlines 11y ago
      So glad that all Swiss providers, mobile as well as dsl, have no fair usage or capping for their unlimited plans. Download or upload 2TB via torrent? - No one cares A friend of mine who works at Swisscom (no. 1 provider here) said they were forced by their software to enter an upper limit, so they just entered the max allowed length of that integer number.
    - anon1385 11y ago
      I got throttled to dialup speeds for a month in ~2007 by my UK ISP (Demon) for downloading over 60gb in a month. The small print mentioned an abuse clause but didn't specify what the actual automatic hard cutoff was. I was very pissed off at the time. Looking back, the funniest thing about it was that I ended up having an argument with one of the support people on a broadband forum and they were arguing that only pirates would ever need more than 60gb and that internet TV was never going to take off because the BBC iPlayer trial hadn't worked well in their browser. These days there are UK ISPs with their own 4K TV channels.
- eddd 11y ago
  As far as I know, bandwidth in US is usually lower than in Europe.
  - realusername 11y ago
    And also more expensive than most European countries.
- TeMPOraL 11y ago
  Yup. I was under the impression that data transfer limits are a pretty American thing, and in Europe they're the hallmark of a shady, crap provider (most commonly a big telco).
  - LoSboccacc 11y ago
    also depends on whether it's a mobile plan or not.
    - TeMPOraL 11y ago
      Yes, that too of course. I was thinking of residential connections.
- zamalek 11y ago
  In South Africa it's sometimes true. Capped copper internet is substantially cheaper (same price as uncapped in the US) and usually higher priority than uncapped. Wireless internet is prohibitively expensive, one such tab can easily deplete a data bundle. However, even uncapped internet normally has a AUP (acceptable usage policy, also soft cap) that is usually around 200GB - exceed it and your internet is de-prioritized to the point of being almost useless. Either way, 4GB favicons are probably unhealthy for the overall internet.
- techdragon 11y ago
  It's true for all of Australia and getting worse each year as the ISPs fight for profits after the country reached market saturation on broadband connections.
- theandrewbailey 11y ago
  I guess his United States isn't the one I live in. Comcast says hi: http://customer.xfinity.com/help-and-support/internet/data-usage-trials/ http://customer.xfinity.com/help-and-support/internet/data-u... AT&T says hi: https://www.att.com/esupport/internet/usage.jsp https://www.att.com/esupport/internet/usage.jsp
zoidb 11y ago
Here is the thread from the last time this surfaced, I guess not much has changed since then? https://news.ycombinator.com/item?id=9720665 https://news.ycombinator.com/item?id=9720665
stestagg 11y ago
Op suggests 5mb limit on Favicons. Assuming a 32x32 pixel display size (retina). That's 1k bytes per pixel!
- Synaesthesia 11y ago
  You can have a long animation on your favicon
  - Qwertious 11y ago
    I have to ask: Why do favicons need the ability to be animated? It's like the ability to autoplay mp3s on a webpage upon loading: There may very well be a use case for it, but there's a pretty big use-case for it NOT being possible, which is that it's pretty goddamn stupid. And since we're clearly not adhering to Unix philosophy on the web, I say that it being idiotic is a good enough reason to not allow for it.
    - TeMPOraL 11y ago
      One thing we need to figure out: how to ban assholes instead of banning features. In general, things can be either interesting XOR safe, and we're killing off more and more interesting things[0] on the web just because some assholes will surely make use of them. [0] - like e.g. calls for rate-limiting access to phone gyroscopes, or banning it altogether, in https://news.ycombinator.com/item?id=10914666 https://news.ycombinator.com/item?id=10914666.
      - stestagg 11y ago
        I agree with you, in principle, BUT there's always a tradeoff to be had. In this case, I don't really see it. As a typical user, I never want my favicon to be more than ~1MB. More interesting effects may be done, but can be done in javascript, for example.
      - pdkl95 11y ago
        > ban assholes Trying to enumerate badness[1] is always the wrong approach, as your list can never be complete. [1] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...
breakingcups 11y ago
Bug trackers: Chrome: https://code.google.com/p/chromium/issues/detail?id=500639 https://code.google.com/p/chromium/issues/detail?id=500639 (reported 2015-06-15, unfixed as of yet) Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1174811 https://bugzilla.mozilla.org/show_bug.cgi?id=1174811 (already fixed on 2015-06-16)
- anon1385 11y ago
  >(already fixed on 2015-06-16) Not so fast. The SVG version in comment 14 isn't fixed yet it seems. https://bugzilla.mozilla.org/show_bug.cgi?id=1174811#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=1174811#c14
Xophmeister 11y ago
...there is no way to tell the size of something you want to download until you've downloaded it. A HEAD request should give you the size of the response body, in octets, in the Content-Length response header. This should (almost) always be present from a well-behaved web server.
- a3_nm 11y ago
  ... with the notable exception of content prepared on the fly, e.g., bulk download of photo albums with some services such as Picasa or Dropbox; the reason being that the zip archive is being prepared in streaming and the server doesn't know its size.
- Lukasa 11y ago
  Only if the file is served as one large chunk. If sent using Transfer-Encoding: chunked, there is no requirement to provide a Content-Length header, and a HEAD request may not show one. The way Go's built in HTTP libraries work is that, if you don't attach a Content-Length header yourself, you will automatically send a chunk-encoded response. That's exactly what the OP's server does, and as a result there is no Content-Length to look for. User-Agents need to defend against this by setting an appropriate upper-limit on the size of the object they want to receive. Note that there's another obvious way to try to consume bandwidth: host a "file download" that actually just sends a chunk-encoded random byte sequence until the connection closes.
  - Grue3 11y ago
    A favicon should probably never be chunked in the first place.
    - Lukasa 11y ago
      Why?
      - stestagg 11y ago
        The body for the majority of favicons should fit into a single tcp packet. Adding the overhead of chunking is completely pointless. Partial icon streams have no use to the client, and given the server should almost certainly have the entire icon in ram, streaming has no use for the server.
zamalek 11y ago
The deeper concern here is this: > until the OS crashes How is it even possible that userspace crashes the OS due to memory exhaustion?
- viraptor 11y ago
  When you run out of memory something needs to be killed, or swapped. If you start swapping, you're not responsive anymore (you can generate data faster than writing it to disk). If you kill something, it may not be the application which needs to be killed. Usually systems don't come preconfigured with a hard per-app limit (which is a bad thing...), or oom score (systemd got this more popular though), so crashing the OS is still fairly easy.
  - Piskvorrr 11y ago
    Making the OS unresponsive, that happens, yes. But I have yet to see a modern OS crash - as in "OOM killed init or some other essential process".
  - ekimekim 11y ago
    My experience is that the OOM killer is generally pretty good at picking the right process to kill. At least on linux, it also considers whether the process has child processes, and kills them preferentially. These two aspect together mean that a linux system should consistently kill the tab loading the favicon and not, say, x11.
    - Piskvorrr 11y ago
      Well, I did see an X11 server killed under unusual circumstances (not :0, but an Xvfb-for-Xpra; incidentally, this also killed its child, which was the offending process)
- deleted 11y ago
  [deleted]
excitom 11y ago
This is a classic example of a DOS attack, the kind of thing 4chan'ers take delight in unleashing on unsuspecting visitors to a web page. Why do it? For the simple joy of screwing with people.
sleepychu 11y ago
I was so suspicious when this page didn't have a favicon... (it's safe)

92 points by ejcx 11y ago

"I believe in most other countries, that aren't the United States, people pay their internet usage by bandwidth used." that's... false

awjr 11y ago
Here in the UK, you can PAY to have unlimited and even that has abuse clauses.
- Ntrails 11y ago
  My originial unlimited iPhone 3g connection had abuse clauses. Nobody cared when I used tethering to download 20gigs of steam games overnight - but if I was perma torrenting they might have done. The contractual limits give the company a legal out to deal with use that starts to impact other customers, they are not commonly enforced unless they are looking into a complaint to slow internet and your usage comes up as anomalous and potentially contributory (according to a friend at an ISP at least).
  - underlines 11y ago
    So glad that all Swiss providers, mobile as well as dsl, have no fair usage or capping for their unlimited plans. Download or upload 2TB via torrent? - No one cares A friend of mine who works at Swisscom (no. 1 provider here) said they were forced by their software to enter an upper limit, so they just entered the max allowed length of that integer number.
  - anon1385 11y ago
    I got throttled to dialup speeds for a month in ~2007 by my UK ISP (Demon) for downloading over 60gb in a month. The small print mentioned an abuse clause but didn't specify what the actual automatic hard cutoff was. I was very pissed off at the time. Looking back, the funniest thing about it was that I ended up having an argument with one of the support people on a broadband forum and they were arguing that only pirates would ever need more than 60gb and that internet TV was never going to take off because the BBC iPlayer trial hadn't worked well in their browser. These days there are UK ISPs with their own 4K TV channels.
eddd 11y ago
As far as I know, bandwidth in US is usually lower than in Europe.
- realusername 11y ago
  And also more expensive than most European countries.
TeMPOraL 11y ago
Yup. I was under the impression that data transfer limits are a pretty American thing, and in Europe they're the hallmark of a shady, crap provider (most commonly a big telco).
- LoSboccacc 11y ago
  also depends on whether it's a mobile plan or not.
  - TeMPOraL 11y ago
    Yes, that too of course. I was thinking of residential connections.
zamalek 11y ago
In South Africa it's sometimes true. Capped copper internet is substantially cheaper (same price as uncapped in the US) and usually higher priority than uncapped. Wireless internet is prohibitively expensive, one such tab can easily deplete a data bundle. However, even uncapped internet normally has a AUP (acceptable usage policy, also soft cap) that is usually around 200GB - exceed it and your internet is de-prioritized to the point of being almost useless. Either way, 4GB favicons are probably unhealthy for the overall internet.
techdragon 11y ago
It's true for all of Australia and getting worse each year as the ISPs fight for profits after the country reached market saturation on broadband connections.
theandrewbailey 11y ago
I guess his United States isn't the one I live in. Comcast says hi: http://customer.xfinity.com/help-and-support/internet/data-usage-trials/ http://customer.xfinity.com/help-and-support/internet/data-u... AT&T says hi: https://www.att.com/esupport/internet/usage.jsp https://www.att.com/esupport/internet/usage.jsp

zoidb 11y ago

Here is the thread from the last time this surfaced, I guess not much has changed since then? https://news.ycombinator.com/item?id=9720665 https://news.ycombinator.com/item?id=9720665

stestagg 11y ago

Op suggests 5mb limit on Favicons. Assuming a 32x32 pixel display size (retina). That's 1k bytes per pixel!

Synaesthesia 11y ago
You can have a long animation on your favicon
- Qwertious 11y ago
  I have to ask: Why do favicons need the ability to be animated? It's like the ability to autoplay mp3s on a webpage upon loading: There may very well be a use case for it, but there's a pretty big use-case for it NOT being possible, which is that it's pretty goddamn stupid. And since we're clearly not adhering to Unix philosophy on the web, I say that it being idiotic is a good enough reason to not allow for it.
  - TeMPOraL 11y ago
    One thing we need to figure out: how to ban assholes instead of banning features. In general, things can be either interesting XOR safe, and we're killing off more and more interesting things[0] on the web just because some assholes will surely make use of them. [0] - like e.g. calls for rate-limiting access to phone gyroscopes, or banning it altogether, in https://news.ycombinator.com/item?id=10914666 https://news.ycombinator.com/item?id=10914666.
    - stestagg 11y ago
      I agree with you, in principle, BUT there's always a tradeoff to be had. In this case, I don't really see it. As a typical user, I never want my favicon to be more than ~1MB. More interesting effects may be done, but can be done in javascript, for example.
    - pdkl95 11y ago
      > ban assholes Trying to enumerate badness[1] is always the wrong approach, as your list can never be complete. [1] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...

breakingcups 11y ago

Bug trackers: Chrome: https://code.google.com/p/chromium/issues/detail?id=500639 https://code.google.com/p/chromium/issues/detail?id=500639 (reported 2015-06-15, unfixed as of yet) Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1174811 https://bugzilla.mozilla.org/show_bug.cgi?id=1174811 (already fixed on 2015-06-16)

anon1385 11y ago
>(already fixed on 2015-06-16) Not so fast. The SVG version in comment 14 isn't fixed yet it seems. https://bugzilla.mozilla.org/show_bug.cgi?id=1174811#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=1174811#c14

Xophmeister 11y ago

...there is no way to tell the size of something you want to download until you've downloaded it. A HEAD request should give you the size of the response body, in octets, in the Content-Length response header. This should (almost) always be present from a well-behaved web server.

a3_nm 11y ago
... with the notable exception of content prepared on the fly, e.g., bulk download of photo albums with some services such as Picasa or Dropbox; the reason being that the zip archive is being prepared in streaming and the server doesn't know its size.
Lukasa 11y ago
Only if the file is served as one large chunk. If sent using Transfer-Encoding: chunked, there is no requirement to provide a Content-Length header, and a HEAD request may not show one. The way Go's built in HTTP libraries work is that, if you don't attach a Content-Length header yourself, you will automatically send a chunk-encoded response. That's exactly what the OP's server does, and as a result there is no Content-Length to look for. User-Agents need to defend against this by setting an appropriate upper-limit on the size of the object they want to receive. Note that there's another obvious way to try to consume bandwidth: host a "file download" that actually just sends a chunk-encoded random byte sequence until the connection closes.
- Grue3 11y ago
  A favicon should probably never be chunked in the first place.
  - Lukasa 11y ago
    Why?
    - stestagg 11y ago
      The body for the majority of favicons should fit into a single tcp packet. Adding the overhead of chunking is completely pointless. Partial icon streams have no use to the client, and given the server should almost certainly have the entire icon in ram, streaming has no use for the server.

zamalek 11y ago

The deeper concern here is this: > until the OS crashes How is it even possible that userspace crashes the OS due to memory exhaustion?

viraptor 11y ago
When you run out of memory something needs to be killed, or swapped. If you start swapping, you're not responsive anymore (you can generate data faster than writing it to disk). If you kill something, it may not be the application which needs to be killed. Usually systems don't come preconfigured with a hard per-app limit (which is a bad thing...), or oom score (systemd got this more popular though), so crashing the OS is still fairly easy.
- Piskvorrr 11y ago
  Making the OS unresponsive, that happens, yes. But I have yet to see a modern OS crash - as in "OOM killed init or some other essential process".
- ekimekim 11y ago
  My experience is that the OOM killer is generally pretty good at picking the right process to kill. At least on linux, it also considers whether the process has child processes, and kills them preferentially. These two aspect together mean that a linux system should consistently kill the tab loading the favicon and not, say, x11.
  - Piskvorrr 11y ago
    Well, I did see an X11 server killed under unusual circumstances (not :0, but an Xvfb-for-Xpra; incidentally, this also killed its child, which was the offending process)
deleted 11y ago
[deleted]

excitom 11y ago

This is a classic example of a DOS attack, the kind of thing 4chan'ers take delight in unleashing on unsuspecting visitors to a web page. Why do it? For the simple joy of screwing with people.

sleepychu 11y ago

I was so suspicious when this page didn't have a favicon... (it's safe)