5 ms·

I was thinking the same thing. Is the content gzip'd on the server? This could be a nice (i.e. evil) way to send a very small response to the browser that would

I was thinking the same thing. Is the content gzip'd on the server? This could be a nice (i.e. evil) way to send a very small response to the browser that would pretty much kill it. a slightly more evil version would be to perhaps do: var x="...2 billion of the same character..."; This should compress very well to gzip, but will likely to exhaust the browser's memory (??)

rcxdude 14y ago
Indeed, there was a 'crash your browser' webpage a few months ago which used this technique I think. Unfortunatly I can't find it currently.
- logn 14y ago
  Oh, I do remember seeing that. Ahh, just fou
olliesaunders 14y ago
This is very similar to the ping of death that requests a undeliverably big ping response.
- plaguuuuuu 14y ago
  Ping of death was +++ath0 which causes a dialup modem to hang up. I have no idea why most modems did this. But by god it was a lot of fun on IRC when I was 14 or so. I still remember the hex string for +++ath0 you'd need to pass into 'ping -p', haha..
  - nickzoic 14y ago
    The "proper" Hayes AT drop-back-to-command-mode sequence was +++ followed by a long pause (1 second or so). Any characters sent during that pause time would invalidate the attempt to switch to command mode. So theoretically this shouldn't happen. However, lots of cheaper modems seemed to not check for the pause, so sending +++ATH0 would make them switch to command mode and immediately process a Hangup command ... not pretty :-).
    - thristian 14y ago
      Specfically, that pause was the part of the Hayes AT command-set that was patented. Therefore lots of manufacturers who didn't want to licence the patent but wanted to have 'Hayes AT compatible' on the box just didn't bother implementing the timeout-cancellation bit.
      - nickzoic 14y ago
        Wow, I didn't know that, it explains a lot.
samwillis 14y ago
You are describing a zip/decompression bomb. Most zip and compression libs protect against them. http://en.wikipedia.org/wiki/Zip_bomb http://en.wikipedia.org/wiki/Zip_bomb
- mey 14y ago
  See also http://en.wikipedia.org/wiki/Billion_laughs http://en.wikipedia.org/wiki/Billion_laughs
- gingerlime 14y ago
  Interesting, but the wikipedia article mentions that antivirus libraries protect against those. Couldn't find much on wikipedia or otherwise talking about browsers or zip libraries that have built-in protection for this...
deleted 14y ago
[deleted]
VMG 14y ago
The easier version would be to just run a crashing script var i = 1, a = []; while(a[i++] = "a" + a);

rcxdude 14y ago

Indeed, there was a 'crash your browser' webpage a few months ago which used this technique I think. Unfortunatly I can't find it currently.

logn 14y ago
Oh, I do remember seeing that. Ahh, just fou

olliesaunders 14y ago

This is very similar to the ping of death that requests a undeliverably big ping response.

plaguuuuuu 14y ago
Ping of death was +++ath0 which causes a dialup modem to hang up. I have no idea why most modems did this. But by god it was a lot of fun on IRC when I was 14 or so. I still remember the hex string for +++ath0 you'd need to pass into 'ping -p', haha..
- nickzoic 14y ago
  The "proper" Hayes AT drop-back-to-command-mode sequence was +++ followed by a long pause (1 second or so). Any characters sent during that pause time would invalidate the attempt to switch to command mode. So theoretically this shouldn't happen. However, lots of cheaper modems seemed to not check for the pause, so sending +++ATH0 would make them switch to command mode and immediately process a Hangup command ... not pretty :-).
  - thristian 14y ago
    Specfically, that pause was the part of the Hayes AT command-set that was patented. Therefore lots of manufacturers who didn't want to licence the patent but wanted to have 'Hayes AT compatible' on the box just didn't bother implementing the timeout-cancellation bit.
    - nickzoic 14y ago
      Wow, I didn't know that, it explains a lot.

samwillis 14y ago

You are describing a zip/decompression bomb. Most zip and compression libs protect against them. http://en.wikipedia.org/wiki/Zip_bomb http://en.wikipedia.org/wiki/Zip_bomb

mey 14y ago
See also http://en.wikipedia.org/wiki/Billion_laughs http://en.wikipedia.org/wiki/Billion_laughs
gingerlime 14y ago
Interesting, but the wikipedia article mentions that antivirus libraries protect against those. Couldn't find much on wikipedia or otherwise talking about browsers or zip libraries that have built-in protection for this...

deleted 14y ago

[deleted]

VMG 14y ago

The easier version would be to just run a crashing script var i = 1, a = []; while(a[i++] = "a" + a);