HN Hall of Fame Weekly email

Defending a website with Zip bombs

blog.haschek.at Essays & writing Essays & articles Security & privacy Candidate
Screenshot of blog.haschek.at captured 2026-07-20
Page preview · captured 2026-07-20

Resurfaced independently across 3 calendar years, with breakout response in 2 of them.

submissions
4
submitters
3
observed span
2017–2024
peak thread · 183 comments
631 pts
latest 20+ return · 2024-01-10
122 pts

Submission timeline

2007–2026

One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.

First comments on top threads

HN comment order

I would think Transfer-Encoding would be a better choice than Content-Encoding. It's processed at a lower level of the stack and must be decoded – Content-Encoding is generally only decoded if the client is specifically interested in whatever's inside the payload. (Note that you don't have to specify the large Content-Length in this case as it is implied by the transfer coding.) Also worth trying is an XML bomb [1], though that's higher up the stack. Of course you can…

related: https://news.ycombinator.com/item?id=14707674 (July 6, 2017 — 183 comments)

The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.

Breakout years
2

100+ points or 50+ comments

Total points
810

reference only — not used in Hall rules or ranking

Total comments
257

reference only — not used in Hall rules or ranking

Every submission

DateTitle as submittedByPointsComments
2017-07-05Defending websites with gzip bombsgeek_at560
2017-07-06Defending a website with Zip bombsFirst breakout · Best threadridgewell631183
2020-01-04Defending your website with ZIP Bombs (2017)geek_at10
2024-01-10How to defend your website with ZIP bombs (2017)Latest 20+ point returnBonoboIO12274