7 ms·

is it actually sending 2M characters over the wire (ie uncompressed)? you could imagine seeing something like this via a glitch in compression (2 million of an

is it actually sending 2M characters over the wire (ie uncompressed)? you could imagine seeing something like this via a glitch in compression (2 million of anything, run length encoded, doesn't take much space). (i guess it's also possible that this really is 2M nulls at a lower level and compression just happens to save you from an embarrassing waste of bandwidth). it's not clear to me what the URL is to check myself.

gingerlime 14y ago
I was thinking the same thing. Is the content gzip'd on the server? This could be a nice (i.e. evil) way to send a very small response to the browser that would pretty much kill it. a slightly more evil version would be to perhaps do: var x="...2 billion of the same character..."; This should compress very well to gzip, but will likely to exhaust the browser's memory (??)
- rcxdude 14y ago
  Indeed, there was a 'crash your browser' webpage a few months ago which used this technique I think. Unfortunatly I can't find it currently.
  - logn 14y ago
    Oh, I do remember seeing that. Ahh, just fou
- olliesaunders 14y ago
  This is very similar to the ping of death that requests a undeliverably big ping response.
  - plaguuuuuu 14y ago
    Ping of death was +++ath0 which causes a dialup modem to hang up. I have no idea why most modems did this. But by god it was a lot of fun on IRC when I was 14 or so. I still remember the hex string for +++ath0 you'd need to pass into 'ping -p', haha..
    - nickzoic 14y ago
      The "proper" Hayes AT drop-back-to-command-mode sequence was +++ followed by a long pause (1 second or so). Any characters sent during that pause time would invalidate the attempt to switch to command mode. So theoretically this shouldn't happen. However, lots of cheaper modems seemed to not check for the pause, so sending +++ATH0 would make them switch to command mode and immediately process a Hangup command ... not pretty :-).
      - thristian 14y ago
        Specfically, that pause was the part of the Hayes AT command-set that was patented. Therefore lots of manufacturers who didn't want to licence the patent but wanted to have 'Hayes AT compatible' on the box just didn't bother implementing the timeout-cancellation bit.
        nickzoic 14y ago
        Wow, I didn't know that, it explains a lot.
- samwillis 14y ago
  You are describing a zip/decompression bomb. Most zip and compression libs protect against them. http://en.wikipedia.org/wiki/Zip_bomb http://en.wikipedia.org/wiki/Zip_bomb
  - mey 14y ago
    See also http://en.wikipedia.org/wiki/Billion_laughs http://en.wikipedia.org/wiki/Billion_laughs
  - gingerlime 14y ago
    Interesting, but the wikipedia article mentions that antivirus libraries protect against those. Couldn't find much on wikipedia or otherwise talking about browsers or zip libraries that have built-in protection for this...
- deleted 14y ago
  [deleted]
- VMG 14y ago
  The easier version would be to just run a crashing script var i = 1, a = []; while(a[i++] = "a" + a);
takluyver 14y ago
I think most HTTP these days uses transparent compression, but I can't find a source for that just now.
brudgers 14y ago
The author's choice of title somewhat implies malfeasance on Microsoft's part. In general, the article seems intended to spread FUD regarding Skydrive. I would point out that if Opera is just now debugging their interaction with Skydrive, it is indicative of how few people use it. While I appreciate the motivations behind it and its rich feature set, I gave up on Opera for Firefox after a year. In part this was the fatigue of experiencing broken websites, in part because of low quality plugins comparable to noscript. Opera would be great if it handled nonstandard html gracefully for me instead of telling me about its high horse and the shoddiness of the websites I use.
- mikeash 14y ago
  Where's the FUD? The tone of the article is fairly strictly factual. The only deviation from facts is where he says that it's bizarre to encounter this, which is an opinion, but still completely reasonable. IMO it is bizarre.
  - Semiapies 14y ago
    The meaning of "FUD" slowly morphed to "saying bad things about software I like" a few years back.
- rplnt 14y ago
  > I gave up on Opera for Firefox after a year And went to use what? IE? Or did you try Opera/FF just recently when Chrome became usable?
  - LockeWatts 14y ago
    Chrome's been usable for something like 4 years now.
    - rplnt 14y ago
      Not really. It wasn't really usable after the release (which was 4 years ago). Constantly crashing, featureless (which it still is, but now you have extensions). I tried it several times in the course of the first year after release and it was really (really) bad. But even if it was 3 years, it's still a short time for a browser to be around. But as leddt pointed out, I misunderstood the comment I replied to.
mikeash 14y ago
Exactly what I was thinking. My best guess is that their data is triggering a latent bug in their gzip compressor which causes it to output something that decompresses to 2MB of zeroes.
CJefferson 14y ago
Just to save anyone else bothering to check, 2M of nulls gzips to almost exactly 2k. Easy to imagine with compression how you could miss that, although it is still a bit embarrassing.

gingerlime 14y ago

I was thinking the same thing. Is the content gzip'd on the server? This could be a nice (i.e. evil) way to send a very small response to the browser that would pretty much kill it. a slightly more evil version would be to perhaps do: var x="...2 billion of the same character..."; This should compress very well to gzip, but will likely to exhaust the browser's memory (??)

rcxdude 14y ago
Indeed, there was a 'crash your browser' webpage a few months ago which used this technique I think. Unfortunatly I can't find it currently.
- logn 14y ago
  Oh, I do remember seeing that. Ahh, just fou
olliesaunders 14y ago
This is very similar to the ping of death that requests a undeliverably big ping response.
- plaguuuuuu 14y ago
  Ping of death was +++ath0 which causes a dialup modem to hang up. I have no idea why most modems did this. But by god it was a lot of fun on IRC when I was 14 or so. I still remember the hex string for +++ath0 you'd need to pass into 'ping -p', haha..
  - nickzoic 14y ago
    The "proper" Hayes AT drop-back-to-command-mode sequence was +++ followed by a long pause (1 second or so). Any characters sent during that pause time would invalidate the attempt to switch to command mode. So theoretically this shouldn't happen. However, lots of cheaper modems seemed to not check for the pause, so sending +++ATH0 would make them switch to command mode and immediately process a Hangup command ... not pretty :-).
    - thristian 14y ago
      Specfically, that pause was the part of the Hayes AT command-set that was patented. Therefore lots of manufacturers who didn't want to licence the patent but wanted to have 'Hayes AT compatible' on the box just didn't bother implementing the timeout-cancellation bit.
      - nickzoic 14y ago
        Wow, I didn't know that, it explains a lot.
samwillis 14y ago
You are describing a zip/decompression bomb. Most zip and compression libs protect against them. http://en.wikipedia.org/wiki/Zip_bomb http://en.wikipedia.org/wiki/Zip_bomb
- mey 14y ago
  See also http://en.wikipedia.org/wiki/Billion_laughs http://en.wikipedia.org/wiki/Billion_laughs
- gingerlime 14y ago
  Interesting, but the wikipedia article mentions that antivirus libraries protect against those. Couldn't find much on wikipedia or otherwise talking about browsers or zip libraries that have built-in protection for this...
deleted 14y ago
[deleted]
VMG 14y ago
The easier version would be to just run a crashing script var i = 1, a = []; while(a[i++] = "a" + a);

takluyver 14y ago

I think most HTTP these days uses transparent compression, but I can't find a source for that just now.

brudgers 14y ago

The author's choice of title somewhat implies malfeasance on Microsoft's part. In general, the article seems intended to spread FUD regarding Skydrive. I would point out that if Opera is just now debugging their interaction with Skydrive, it is indicative of how few people use it. While I appreciate the motivations behind it and its rich feature set, I gave up on Opera for Firefox after a year. In part this was the fatigue of experiencing broken websites, in part because of low quality plugins comparable to noscript. Opera would be great if it handled nonstandard html gracefully for me instead of telling me about its high horse and the shoddiness of the websites I use.

mikeash 14y ago
Where's the FUD? The tone of the article is fairly strictly factual. The only deviation from facts is where he says that it's bizarre to encounter this, which is an opinion, but still completely reasonable. IMO it is bizarre.
- Semiapies 14y ago
  The meaning of "FUD" slowly morphed to "saying bad things about software I like" a few years back.
rplnt 14y ago
> I gave up on Opera for Firefox after a year And went to use what? IE? Or did you try Opera/FF just recently when Chrome became usable?
- LockeWatts 14y ago
  Chrome's been usable for something like 4 years now.
  - rplnt 14y ago
    Not really. It wasn't really usable after the release (which was 4 years ago). Constantly crashing, featureless (which it still is, but now you have extensions). I tried it several times in the course of the first year after release and it was really (really) bad. But even if it was 3 years, it's still a short time for a browser to be around. But as leddt pointed out, I misunderstood the comment I replied to.

mikeash 14y ago

Exactly what I was thinking. My best guess is that their data is triggering a latent bug in their gzip compressor which causes it to output something that decompresses to 2MB of zeroes.

CJefferson 14y ago

Just to save anyone else bothering to check, 2M of nulls gzips to almost exactly 2k. Easy to imagine with compression how you could miss that, although it is still a bit embarrassing.