×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

TinyDisk, A File System on Someone Else's Web App

ScuttleMonkey posted more than 7 years ago | from the all-your-byte-are-belong-to-us dept.

The Internet 188

Psy writes "I attended Phreaknic this weekend where Acidus released TinyDisk, a shared file system that runs on top of TinyURL or his own implementation NanoURL. TinyDisk compresses a file, encrypts it, and dices it into clusters. Each cluster is submitted to TinyURL as if it were a url. This clusters can be read back out of the database, making TinyDisk a global file system anyone can use. There are safeguards in the default config to prevent people from dumping gigs of MP3s into TinyURL. While file-system-on-web-applications are nothing new (GMail file system anyone?) this hack shows how easy it is to accidentally design a web application insecurely despite the default PHP protections. See his presentation for more info"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

188 comments

Nifty hack (4, Interesting)

FidelCatsro (861135) | more than 7 years ago | (#13870615)

This does seem to be a bit of an abuse of the service. whilst it does not contravene the TinyURL terms of use in any real way
Terms of use:
TinyURL was created as a free service to make posting long URLs easier. Using it for spamming or illegal purposes is forbidden and any such use will result in the TinyURL being disabled and you will be reported to all ISPs involved and to the proper governmental agencies. This service is provided without warranty of any kind.
, it just seems rather untoward .

Nifty little program all the same and a nice hack ,
Having it running on his NanoURL implementation locally , could allow for a cool little service . Though there are better ways to offer web based file systems in the real world .

He does state in the FAQ that its not intended to pollute TinURL in any way .. but this is what some people will use it for (and I doubt the restrictions will be hard to remove).

Perhaps it will give TinyURL a nudge to tighten up their security though .

Re:Nifty hack (1, Insightful)

Anonymous Coward | more than 7 years ago | (#13870680)

who hasnt had this idea to hide data in multiply dns records, or webhops, frame redirectors. I dont think i ever thoguht of putting it into use with a frontend for files. always thought it was kinda for malware to use. or cheap ppl like myself.

It's simple. (2, Insightful)

TheSpoom (715771) | more than 7 years ago | (#13870732)

If you want your online app to not be used by scripts such as this, implement a CAPTCHA [captcha.net] . Sure, people could still use it if they wanted to input a bunch of letters for every single chunk of their file...

Re:It's simple. (4, Insightful)

Smidge204 (605297) | more than 7 years ago | (#13870753)

Or better yet, validate all entered URLs by attempting to establish a connection to the server. If the URL is invalid then kick it back.

You wouldn't even need to do this with every URL added to the system. Spot-checking every 1 in 10 URLs or so will go a long way to preventing any sort of abuse.
=Smidge=

Re:It's simple. (2, Informative)

FidelCatsro (861135) | more than 7 years ago | (#13870811)

That is a great idea . It would also double as a feature , incase anyone accidentally mistypes a URL or misses a chunk at the end during a copy/paste

Re:It's simple. (0)

Anonymous Coward | more than 7 years ago | (#13870903)

Or better yet, validate all entered URLs by attempting to establish a connection to the server. If the URL is invalid then kick it back.

But you put the payload as a query string to a page that didn't care, e.g. http://www.microsoft.com/?MYPAYLOAD [microsoft.com] , to get back a valid response.

Re:It's simple. (3, Interesting)

Chi-RAV (541181) | more than 7 years ago | (#13870921)

not really. as the author of the hack already proposed, you can add hosts of sites that have base64 encoded urls which means that you can get http://www.bleh.org/topic.php?= [bleh.org] and then the prog will filter out the part for use in the decrypting... surely if you use big enough sites (amazon, google, again as the author proposed) you can circumvent this. The point of this "hack" isnt really to show how to break tinyurl but to create a different way of approaching networked file systems, using only HTTP POST/GET. I for one see great potential in this for the likes of Al Qaida (you know, where better to hide your building hitlist than on tinyurl).

Re:It's simple. (1)

Bogtha (906264) | more than 7 years ago | (#13871097)

You wouldn't even need to do this with every URL added to the system. Spot-checking every 1 in 10 URLs or so will go a long way to preventing any sort of abuse.

Actually, that would only make things worse, as the filesystem code would simply have to resubmit 10% of queries, doing nothing but drive the load up further. Assuming, of course, that the trick suggested by the AC where all the data is stored in the query string is not used.

Re:It's simple. (1)

cavemanf16 (303184) | more than 7 years ago | (#13871289)

Even 1 in 10 would be overkill. From TinyURL's website:

"Making long URLs useable! More than 11 million of them. Over 200 million hits/month."

Let's assume that 11 million items = roughly 1 million items submitted each month. 'Spot-checking' only 2500 submitted URL's per month would get you within 99.98% accuracy of finding false URL's. In other terms: if you spot check 2500 URL's per month, you will catch at least one invalid URL each month, 99.98% of the time. That's hardly a noteworthy load on a server that's serving up 200M+ page hits per month, and I don't doubt they will indeed implement such a feature now that NanoURL has been released. What I do find quite interesting is how one (or many) smart people could use these types of wild ideas to continue to circumvent security measures in the future, and potentially no authority would be the wiser. But of course we should still check people's shoes for bombs before they board a plane. :-/

Re:Nifty hack, or antisocial behavior? (5, Insightful)

Anonymous Coward | more than 7 years ago | (#13870804)

It is a nifty hack, but let's not kid ourselves and pretend this is anything new, or that it's even a good thing.

At its core, Tinyurl is just a write-once database. You add data and get back a key/pointer to said data. As with typical databases, the size of the pointer is logarithmic in the size of the input (* number of keys stored, not bytes; however, the number of bytes/key is bounded under some constant, so it's effectively the number of bytes).

This gives us a logarithmic compression scheme, where our compression ratio (N-logN)/N approaches 100% as N gets large. This kind of "infinite compression" is what makes the method attractive: you put in say a kilobyte of data and get out a (currently) 5 byte key. All you have to do is keep an index of the keys.

TinyDisk doesn't seem to do this, but you could then turn around and store the index as a key. Take 1000/5 = 200 keys and get back one key. Lather. Rinse. Repeat. In the end, you have a single key that points to the backup of your mp3 collection, all in one TinyUrl! Not too shabby. After all, it's free storage, right? Wrong. Someone ends up paying for the infinite compression. In this case, it's Tinyurl. If this kid had stopped to think for a few minutes before publishing his hack, he would have realized that he's actually doing a malicious, antisocial thing. I suspect there will be a dozen copycats in the wild before the end of the day.

Farewell TinyUrl, we knew ye well.

Re:Nifty hack, or antisocial behavior? (1)

qwijibo (101731) | more than 7 years ago | (#13871230)

Only corporations should act malicious and antisocial? That doesn't seem very fair. Why are you picking on the little sociopaths? At least it's possible to do something about them. Once you get a large corporation interested in a new form of plundering, it's all over.

I don't really see this as abuse as much as the fundamental flaw in providing free services. If the cost to support the service is higher than the cost to the recipient, it's just a matter of time before someone finds a way to cut their costs by increasing someone else's.

Re:Nifty hack, or antisocial behavior? (0)

Anonymous Coward | more than 7 years ago | (#13871306)

He's acting antisocial by creating an untimely demise of a free service that others have thus-far been able to use cooperatively. Sure, TinyUrl could go to a CAPTCHA system without affecting its intended users, but will they? Or will they just shut down when they get a few GB of new URLs today? If his true intent was to get them to plug the hole, he should have gone to the admins of TinyUrl and explained to them the problem. Demonstrating it on a global scale is not a way to win friends. It's antisocial.

My slashdot CAPTCHA word is sadness. How apropos.

Re:Nifty hack, or antisocial behavior? (2, Insightful)

ezzzD55J (697465) | more than 7 years ago | (#13871406)

In the end, you have a single key that points to the backup of your mp3 collection, all in one TinyUrl! Not too shabby.

Sure, but I think it's a pretty dumb idea because of the large overhead (in time and data) of actually retrieving that data.. http request and response, encoding, etc. And the fact that tinyurl will (rightly) kick your ass off the service once he's on to you.

Problems ahead? ;) (4, Funny)

sznupi (719324) | more than 7 years ago | (#13870620)

TinyURL might become not so tiny anymore...

Re:Problems ahead? ;) (1)

Knx (743893) | more than 7 years ago | (#13870723)

TinyURL might become not so tiny anymore...

And if we go a step further, there might be no TinyURL anymore, actually. While the hack is -- arguably -- interesting, this is clearly a misuse / abuse of the system, which is likely to make their DB grow at an unexpected rate, not talking about wasted bandwidth.

Re:Problems ahead? ;) (1)

Knx (743893) | more than 7 years ago | (#13870997)

Big deal ... just change the name to NotSoTinyAnymoreURL, and that's fixed!

TinyDisk? (0)

BladeMelbourne (518866) | more than 7 years ago | (#13870624)

I got a BigDisk - I dont know about you guys.
I love to upload DNA strands using it.

Re:TinyDisk? (1, Funny)

orasio (188021) | more than 7 years ago | (#13870908)

Maybe you sould review your logs:
2005-10-25 04:55:23 - Uploading DNA .....
2005-10-25 04:55:35 - ftp: kleenex.tissue: Unknown host
2005-10-25 04:55:36 - DNA Upload failed. Cleaning up... OK.
2005-10-25 04:55:46 - Retrying Upload DNA .....

I have a fwiend in Wome ... (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#13871000)

... named Bigus Diskus!

From what I understand (4, Informative)

FST (766202) | more than 7 years ago | (#13870626)

I saw this a few hours ago, and from what I understand the process goes as follows:

1- Open a meta file
2- Retrieve and concatenate all the clusters from TinyURL in the order
specified in the meta file.
2- Base64 decode the file
3- Decrypt the file with the algorithm and key in the meta file
4- Decompress the file with the algorithm in the meta file.
5 - Verify the file size given in the meta file is correct for the
decoded/decrypted/decompressed file
6- Verify the checksum with the algorithm and value in the meta file matches
for the decoded/decrypted/decompressed file
7- Set the filename of the decoded/decrypted/decompressed file to the
filename specified in the meta file.

Hope that helps somebody :)

Solution for which problem? (4, Interesting)

't is DjiM (801555) | more than 7 years ago | (#13870692)

That's pretty much what I understood.

I adore the ingenuity (correct spelling?) of the hack but... I can't really find a problem this hack is a solution for.

As a way to distribute files, it's probably too slow. The pro's I see here: the file is not stored as one single file but it's stored as a distributed file (a set of Base-64 encoded clusters), making removal of the file hard. On the other hand, if one single segment drops out, the file will be destroyed (except if some redundancy exists, of which I did not find evidence).

If you want to send attachments in an e-mail, this is a very complicated way to do it. Every receiver must have the decoder program to re-assemble the file.

Moreover, if tinyURL builds in a check to see whether the submitted URL exists (not just some 404 page), the whole concept would probably break.

Anyways, very clever hack!

Re:Solution for which problem? (2, Interesting)

acariquara (753971) | more than 7 years ago | (#13871043)

Simple, guerrilla distribution of files that would be illegal but not immoral - DeCSS, anyone?

Also, it could be used for distributing small text files containing reports from warzones and other heavy-censored countries. EFF should have a blast on this one.

Insecure? Really? (5, Insightful)

Afty0r (263037) | more than 7 years ago | (#13870632)

this hack shows how easy it is to accidentally design a web application insecurely despite the default PHP protections.
The design of these TinyURL style applications is insecure in the same way as a concrete wall is insecure because someone could spray paint on it.

Insecure? Rancid tabloid hyperbole more like.

Re:Insecure? Really? (1)

LarsWestergren (9033) | more than 7 years ago | (#13870697)

Rancid tabloid hyperbole more like.

Well, your reaction is not very restrained either.

Hang on. Is it hyperbole day on Slashdot and no one told me? obBart: "This is the greatest injustice in the history of mankind!"

Re:Insecure? Really? (4, Funny)

xappax (876447) | more than 7 years ago | (#13870947)

Is it hyperbole day on Slashdot and no one told me?

Hyperbole day? That's the most ridiculous thing I've ever heard in my entire life!

Re:Insecure? Really? (1)

LarsWestergren (9033) | more than 7 years ago | (#13871136)

Hyperbole day? That's the most ridiculous thing I've ever heard in my entire life!

Of course, on Slashdot, every day is hyperbole day!

Re:Insecure? Really? (1)

YU Nicks NE Way (129084) | more than 7 years ago | (#13871207)

If I've told you once, I've told you a thousand times: the first rule of Slashdot Hyperbole Day is that you don't mention hyperbole day!

Re:Insecure? Really? (1, Informative)

Anonymous Coward | more than 7 years ago | (#13870760)

URLs could be checked on the serverside on availability for example; if your URL is phony, then it's rejected. I suppose that would make massive DOS-attacks possible, but hey - we could also do a count on the frequency that URLs are submitted from one source, _and_ we could count the amount of times a certain host is referenced.

Re:Insecure? Really? (3, Insightful)

julesh (229690) | more than 7 years ago | (#13870939)

URLs could be checked on the serverside on availability for example; if your URL is phony, then it's rejected. I suppose that would make massive DOS-attacks possible

It would also prevent tinyurl being useful for private URLs (e.g. those behind firewalls which only allow connections from known IP addresses). You can also use currently use tinyurl with protocols that the tinyurl server knows nothing about, e.g. ed2k: or magnet:.

The better solution is just to disallow any single IP from creating more than, say, 10 URLs in an hour. This would make such a filesystem implementation useless without overly restricting legitimate users.

Re:Insecure? Really? (1)

guitaristx (791223) | more than 7 years ago | (#13871616)

The better solution is just to disallow any single IP from creating more than, say, 10 URLs in an hour. This would make such a filesystem implementation useless without overly restricting legitimate users.

What about set-ups where a large number of users (say > 1000) are masqueraded behind one IP address?

Hyper Bowl?! (0)

Anonymous Coward | more than 7 years ago | (#13871161)

Sounds like fun! Where do I sign up?!

Re:Insecure? Really? (0)

Anonymous Coward | more than 7 years ago | (#13871364)

In fact every place, which enables anonymous cowards to store any information could be used as "a filesystem". Even slashdot postings.

==Begin DATA FRAME==
M+#4P#:!6X%==X)NH]&N+K4)#@B'RD^K$$_H/UKGI,AL^)M;&L W2*
M!'X4ZB@!%8,,J01[4M1LL;G+8)'.8BRKN7^A_6@"Q16)+K=]8 L
MWV_0[ORATFLV%POXJ,./^^34EAXIT+4YO(M=5M6N`O3/%2T4` 9E]81C3[B)+2.XAEC*RV9`
MVS*1@J`.>0+QF*4*0!W&0,YQ[GIWJU10`44R5VCB9U
MC:0J,[%(R?89XS5#5%6X6.WD\^.-I!BXMY-K0O\`PD^QZ=QS@ C%`&E7&7_B&
M7Q!K,NA:#B6.!BE[=`_(C=TS[=_8K9O(=2U'1KBSCFFM;AB8& NHL1LH(P9$
==End DATA FRAME==

(Okay, you got to break the CAPTCHA).

NanoURL review (5, Funny)

Anonymous Coward | more than 7 years ago | (#13870634)

I like NanoURL but it scratches real easily.

I'm sure this won't be abused (3, Interesting)

Dekortage (697532) | more than 7 years ago | (#13870635)

Pretty soon you'll see someone trying to use this as their backup system for 30gb of pr0n. Will large files kill TinyURL? What kind of latency is this going to introduce? If nothing else, this might constitute a DoS attack on TinyURL.com (which would be illegal.

It's still interesting work.

Re:I'm sure this won't be abused (1, Funny)

FidelCatsro (861135) | more than 7 years ago | (#13870649)

I don't think it would constitute a DOS attack (unless someone was trying to DOS it deliberately using said program) it would just be overloading the servers. if it did constitute one Slashdot would have a criminal record the length of the Nile .

Re:I'm sure this won't be abused (1)

Dekortage (697532) | more than 7 years ago | (#13870744)

You're probably right. "Illegal" is too much.

Though, when Slashdot readers kill a server, it's because thousands of people are trying to legitimately access information that is put online for this purpose. If thousands of people kill TinyURL because they're swapping large files, it is frankly an illegitimate use of the service. Maybe not illegal, but certainly inappropriate to the vast detriment of the service and its other customers. Your public library is free, too, but if a bunch of people began standing in the doorway to swap goods and kept other patrons out, the police would probably show up to eject them.

Re:I'm sure this won't be abused (0)

Anonymous Coward | more than 7 years ago | (#13871342)

Worst Moderation ever.
First funny and then overrated, Moderators please abandon your crack pipe .

Re:I'm sure this won't be abused (2, Insightful)

MichaelSmith (789609) | more than 7 years ago | (#13870665)

It's still interesting work.

Even more interesting would be something which encrypts your files and spreads them around in various free storage media (slashdot trolls?) in such a way that they can not be easily correlated with each other.

Cramming all this stuff into tinyurl is bound to be noticed, but if it is a couple of dozen bytes here and there it might be possible to store lots of stuff with a reasonable degree of safety.

Re:I'm sure this won't be abused (1)

Dekortage (697532) | more than 7 years ago | (#13871276)

if it is a couple of dozen bytes here and there it might be possible to store lots of stuff with a reasonable degree of safety.

Wow... this gaves me a great idea... the Slashdot Sig File System!

Default PHP protections? (4, Funny)

Egregius (842820) | more than 7 years ago | (#13870638)

Bwahahahahaha.

Re:Default PHP protections? (1)

bsytko (851179) | more than 7 years ago | (#13870676)

I agree, its more like, what default PHP protections? PHP as little to none default protection so much so that they make it insecure by default. You would have to go through a considerable amount of work to make any script secure.

Re:Default PHP protections? (1)

digitalstruct (906825) | more than 7 years ago | (#13870884)

He is talking about the protections that are automatically set in php.ini. There really isn't many and more of the security problems are due to the large undertaking of people that have no clue on how to really code php. Thus introducing a security problem. I could basically have the same thing happen with perl, asp, asp.net, cold fusion, etc. Security problems are more noteful on a specific case and not towords the language itself.

Re:Default PHP protections? (2, Informative)

digidave (259925) | more than 7 years ago | (#13870940)

"PHP as little to none default protection so much so that they make it insecure by default. You would have to go through a considerable amount of work to make any script secure."

Really? So in what way is 'echo "hello world";' insecure? The only PHP scripts that are insecure are the ones where programmers made stupid decisions or wasn't thinking the design through, just like in any other language. 99% of these PHP problems are using external data without checking it. 99% of those cases are where the programmer didn't use the readily available tools such as prepared SQL statements.

In fact, with PHP in its default configuration, a script that does not accept user data has zero chance for exploitation. You do get cases where programmers do exceedingly stupid things such as get data in such a way as so internal data can be injected, but programming that way is actually much more difficult than doing it the right way. Programs ported from very old versions of PHP may suffer from this if they weren't ported properly.

Anyway, this is all aside from the fact that the TinyURL issue isn't a vulnerability caused by PHP. The program is working exactly as intended, but the programmers didn't think about it being used in this way. They could have easily written a couple lines of code to check to make sure the URL is valid before accepting it.

Re:Default PHP protections? (1)

Bogtha (906264) | more than 7 years ago | (#13871166)

99% of these PHP problems are using external data without checking it.

And the main reason for that is the brain-dead magic quotes feature - i.e. not only is the grandparent wrong about no default security, but it's actually the default security that causes the problems he's complaining about.

Re:Default PHP protections? (1)

n0-0p (325773) | more than 7 years ago | (#13871042)

The security issue is a design flaw, and I've never seen a language that can really protect you from design flaws. That stated, I've reviewed millions of lines of code across at least a dozen languages and I consider PHP one of the worst from a security and maintainability perspective. The only built in protection mechanism I know of is magic quotes. And I really consider magic quotes an extremely poor sustitute for parameter binding that you get with properly implemented prepared statements or stored procedures.

Good web app frameworks offer things like mandatory site-wide authentication, integrated user roles, and basic XSS filtering by default. They're also designed to enforce seperation of tiers, so you can remove your presentation from your business logic. And if you're using stored procedures, you can actually establish a hard security perimeter between your data and logic tiers. I haven't identified good support in PHP for any of these approaches. It's not that it's impossible, but the platform sure doesn't help you.

Unfortunately I haven't had a chance to look at much PHP5 code. It looks like they addressed some of the more glaring language issues, but the platform still leaves a lot to be desired in my opinion. I could be wrong though, as I don't review a lot of PHP. I'd appreciate if any PHP wizards would identify errors in my assessment of the platform.

Re:Default PHP protections? (1)

Christianfreak (100697) | more than 7 years ago | (#13871209)

I code PHP for a living and I agree with everything you say. For logic/presentation seperation there is Smarty [php.net] , but its definately not something a lot of PHP developers know about.

I haven't seen a whole lot of PHP 5 either, but from what i have seen they mostly concentrated on fixed a lot of the OO problems. Which is good but I was hoping they would address some of the more serious (IMHO) problems with the underlying language (adopting a standard naming scheme for functions, maybe creating some namespaces, having real arrays ... etc.)

You could do this with blogs or any CMS (4, Insightful)

tezza (539307) | more than 7 years ago | (#13870696)

You could put this in an unapproved pending queue for Wikipedia, comments on Joel Spolsky's blog or wherever.

But overall 'WHY?' must be the question? Al Quaeda or The Real IRA? They still have their old working communication channels. Also who needs space like this? Space of this amount could be made redundant and available by using GoogleMail, Yahoo and Hotmail in synchrony. If none of those are available, presumably you'd have it on USB key as well.

Re:You could do this with blogs or any CMS (2, Informative)

Bogtha (906264) | more than 7 years ago | (#13870791)

But overall 'WHY?' must be the question?

I've used something similar myself, and there are a few obscure reasons for hiding data in somebody else's web application.

For instance, Opera's UserJS (the inspiration for Greasemonkey) doesn't have a restriction-free XMLHttpRequest object, so the only information you can retrieve with it is from the original host. Stuffing data onto that host is sometimes the only way of making some features work.

Re:You could do this with blogs or any CMS (1)

julesh (229690) | more than 7 years ago | (#13870966)

But why would that host ever be tinyurl.com?

Re:You could do this with blogs or any CMS (1)

Bogtha (906264) | more than 7 years ago | (#13870987)

Well this is just a neat trick, a proof of concept, isn't it? The same techniques can apply to most web applications, this is just demonstrating the principle. Don't get too caught up in which host was used for the example.

Re:You could do this with blogs or any CMS (0)

Anonymous Coward | more than 7 years ago | (#13870819)

Oh I dont know, maybe someone trying to release to the public the laws under the Patriot act that are deemed secret. (Only terrorists want to know the laws) Someone wanting to release information that is hugely beneficial to humanity but will get them killed for it (another terrorist only use)

Re:You could do this with blogs or any CMS (1)

julesh (229690) | more than 7 years ago | (#13870991)

Someone wanting to release information that is hugely beneficial to humanity but will get them killed for it (another terrorist only use)

I wouldn't trust tinyurl.com not to keep logs with enough info to identify me if somebody was that desparate to find me. Far better to go through a service that is, at least, supposed to be anonymous.

Furthur Compression (5, Interesting)

hoshino (790390) | more than 7 years ago | (#13870706)

I noticed that the whole of Alice in Wonderland is compressed to just 20 clusters and each cluster is represented by the five-letter keys used by TinyURL. So is it not possible, using the same method, to reduce the entire metafile (which is merely a textfile of less than 1kB) into a single-line URL? Then you can have the program retrieve the metafile from the URL and the actual file from the metafile. So instead of sending people a metafile, you can just copy and paste them one line of URL.

Re:Furthur Compression (2, Insightful)

grimJester (890090) | more than 7 years ago | (#13870779)

Which makes it more like what it really is, hosting your file on someone else's web server. "Compression" my ass.

Re:Furthur Compression (1)

10101001 10101001 (732688) | more than 7 years ago | (#13871296)

Think about that for a second. The reason the metafile exists is to not only provide the url(s) of the file, the filename, and the filesize, but it also includes the encryption key. Ie, if you upload the metafile(1), you're going to need a metafile(2) with a key to get the metafile(1). Ie, no, it won't work.

Re:Furthur Compression (1)

Bazman (4849) | more than 7 years ago | (#13871551)

"Furthur"? You ARE Cowboy Neal!

See here [wikipedia.org] if that was indeed simply a typo!

Holy.. cool technology overload.. (1)

jkind (922585) | more than 7 years ago | (#13870733)

Encryption, clusters, nano.. Why don't they encode the tiny clusters to DivX while they're at it and embed it in the silences in movies... :)
This sounds like a very cool conference, are they going to distribute a conference program in pdf format, or is Phreaknic too underground for that, and require you to get it off torrent ??

Repeal the 19th ammendment (-1, Troll)

Anonymous Coward | more than 7 years ago | (#13870736)

Repeal the 19th ammendment

Death To women's Rights.

Re:Repeal the 19th ammendment (0, Troll)

Elad Alon (835764) | more than 7 years ago | (#13871135)

Death To women's Rights.
For the millionth time, Jerry, I apologize for sleeping with your wife! We were both drunk and we both regret it. It's been 20 years now, so for heaven's sake. Please, let it go!

What does PHP have to do with it? (5, Informative)

miknight (642270) | more than 7 years ago | (#13870758)

Sure, well all know PHP is far from synonymous with security, but this seems to be a case of exploiting a web app using only the mechanics intentionally made available, just in a novel way. Seems like some unfounded (though not necessarily undeserved) PHP bashing.

article defends PHP; no bashing (1)

brlewis (214632) | more than 7 years ago | (#13870964)

The underlying message is that web application development is inherently difficult to secure, despite PHP's valiant attempts to protect programmers from themselves. This is the opposite of PHP bashing. It's PHP apologetics.

I disagree with the article's premise. It seems to me the same sort of mindset that attributes to "pilot error" aviation incidents that would better be attributed to poorly designed instrumentation.

Re:article defends PHP; no bashing (1)

miknight (642270) | more than 7 years ago | (#13871483)

Sure, I agree. I wasn't very clear that I was referring to the article submitter's comment "...despite the default PHP protections."

Google and banks (-1, Offtopic)

obli (650741) | more than 7 years ago | (#13870765)

Google's got a similar way of using unorthodox methods of sending data.
If you're in the AdSense program and want to get your first payment via electronic wire they won't contact you bank to verify your account, but try to deposit a small sum of money, then ask the user to verify the exact amount.

Naturally this won't have any other good uses as it would be the most expensive way to send data ever, just imagine every few bytes costing you a cent. I wouldn't complain about recievng that data, though...

Re:Google and banks (MODS ON CRACK!) (2, Interesting)

julesh (229690) | more than 7 years ago | (#13871021)

PayPal UK used to use the same technique to validate you were the owner of a credit card: make a small reverse payment and ask you how much it was. Then they got proper integration with the banks and stopped doing it like that.

And WTF is this modded 'offtopic'?

The end of TinyURL. (2, Insightful)

tmroyster (309750) | more than 7 years ago | (#13870866)

The end of TinyURL is in sight. Yes, this is (probably) a clever hack.
But this is a misuse of a really useful service.

When TinyURL's administrator has to either go out and buy his
second 2Terabyte disk array in a week or shutdown, which do
you think he will pick?

Re:The end of TinyURL. (-1)

Anonymous Coward | more than 7 years ago | (#13870911)

He could just ensure that any url posted actually resolves, or just pattern match it using a good url validator.... bang, bye-bye tinyDisk.

Re:The end of TinyURL. (0)

Anonymous Coward | more than 7 years ago | (#13871001)

>He could just ensure that any url posted actually resolves, or just pattern match it using a good url validator...

Google search always resolves. As a proof of concept, I made a tinyurl to a google search for "int main() { printf("hello, world!\n"); }," but I decided against posting the tinyurl because slashdotters have a bad case of the clickies. Anyway, it's very straightforward to encode your data as a google search. Then all you have to do is decode your data out of the search URL!

Re:The end of TinyURL. (1)

cbr2702 (750255) | more than 7 years ago | (#13871112)

He'll just restrict traffic by IP. Any legit user will not be making more than one request per second.

Re:The end of TinyURL. (1)

Slashcrap (869349) | more than 7 years ago | (#13871536)

The end of TinyURL is in sight. Yes, this is (probably) a clever hack.
But this is a misuse of a really useful service.


You're scaremongering and being sensationalist. Have you considered a career as a Slashdot editor?

Seriously - this app encodes your data as URLs. Imagine splitting a DVD image into URL sized chunks and then submitting them one by one. Does that sound like a workable storage system to you?

And as for abusing TinyURL, you could do it with a tiny shell script generating and submitting random URLs. Much faster and more efficient and anyone could do it. So why do you think that this proof of concept code is more dangerous? Can you explain your reasoning? Or did you just get suckered by the Slashdot editors?

Re:The end of TinyURL. (1)

SFEley (743605) | more than 7 years ago | (#13871614)

He'll pick option C, which is to not allow one address to create more than a few TinyURLs in one day, or option D, which is to start validating URLs more carefully.

TinyDisk is an abuse of the system, but it's an intentional one designed to point out that TinyURL could have been implemented with a bit more caution. The fixes to prevent this sort of abuse are easy.

Video/Overview of Acidus's presentation (4, Informative)

Anonymous Coward | more than 7 years ago | (#13870917)

Here [wilpig.org] is a video of Acidus's presentation. If you haven't seen him present before (At Hope, O'Reilly's E-Tech, Toorcon, Phreaknic, Interz0ne, etc, etc) he puts on a good show.

The presentation was called: Layer 7 Fun: Extending web applications in interesting ways. He discusses how traditional web applications work -vs- "new" web ppas that use AJAX. He talks about writing extensions to web apps using an API supplied (ala Housingmaps.com, or chicagocrime.org). Finally he talks about writing an extension to a web app where you don't have access to an API. TinyDisk was a case study for writes these so-called "non-sanctioned" extensions. He has a funny little slide he goes back to about how to properly implement a web app (which TinyRUL fails to do). Things like "don't wallow users to uploaded arbitrary amounts of data directly into your database."

Funny Stuff. His upcoming talk at Shmoocon [shmoocon.org] seems pretty cool too.

Book names - Recommended Reading (3, Informative)

eltoyoboyo (750015) | more than 7 years ago | (#13870936)

In the Recommended reading section this is stated:

There are definitive works in certain fields that online guides and HOWTOs cannot even approach in terms of detail or quality. It's a class of books that are so familiar people refer to them by nicknames instead of by full title.

Well maybe so, but I did not know them all, and in the interest of helping people along the path here they are:

Books like:
K&R,
The C Programming Language by Brian W. Kernighan and Dennis M. Ritchie
The Dinosaur Book, Operating System Concepts by Abraham Silberschatz
Knuth's never-ending story, The Art of Computer Programming, but Donald Knuth
The White Book, Introduction To Algorithms by Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, and Cliff Stein
P&H, Computer Organization and Design The Hardware/Software Interface David Patterson John Hennessy
The Illustrated's. TCP/IP Illustrated Series (The Illustrated's) - W. Richard Stevens
The Rainbow series. U.S. DOD Computer Security Series

Security isn't the issue; resource exploitation is (4, Insightful)

rjamestaylor (117847) | more than 7 years ago | (#13870951)

Sorry to be Mr. Obvious this morning, but I take issue with submitter's conclusion that TinyDisk illustrates a security issue on the part of tinyurl.com. It rather illustrates the ease of creating a leachable web app that resource pirates can abuse. Yes, I have a negative opinion of those using such a creative hack against others who provide services to the general public in good faith.

Re:Security isn't the issue; resource exploitation (1)

TheSync (5291) | more than 7 years ago | (#13871671)

Is there an open source "human filter" for web aps (like the kind that makes you type what is in an image of noisy and/or distorted numbers and letters?

Why not go further? (3, Interesting)

SamSim (630795) | more than 7 years ago | (#13870974)

Take the list of cluster URLs [msblabs.org] . Concatenate them into a single URL. Submit it again. Thus compressing literally ANY file to five characters.

At least, as long as the possibility space of five-character URLs isn't exhausted. It's very much first come, first served.

Great Idea! (3, Insightful)

Se7enLC (714730) | more than 7 years ago | (#13871014)

I was looking for another way to store files online in such a way as to make them:
  • Difficult to access
  • Unreliable
  • Split into many different pieces
  • Under somebody else's control that has motivation to delete them

I guess once this goes down, I'll have to go back to posting UUencoded files in peoples blogs.

Poor fellow (0)

Anonymous Coward | more than 7 years ago | (#13871157)

I wonder how much longer tinyurl will last once people start dumping gigs of porn and pirated movies onto it, broken into millions upon millions of fake urls.

Where's the security issue? (0)

Anonymous Coward | more than 7 years ago | (#13871167)

Where's the security issue?

I could make a similar "file system" with any website that allows users to create accounts and post some information online. I could split a file in some packets, create a Slashdot account for each, and post the packet's content and some meta information in that account's journal.

It's not a file system (1)

danielsanII (925610) | more than 7 years ago | (#13871186)

It's not a file system, because it doesn't even closely implement any POSIX semantics. It's more like P2P, without the P2P :)

Also, I don't really get what's so special about this. I mean, you could also UUEncode files and post them to a forum (or even different forums), and find some way to reassemble these files.

Now make it RAID 10 (1)

stuffduff (681819) | more than 7 years ago | (#13871224)

Spread it across a bunch of servers, and as soon as you have enough parts rebuild the file. Maybe use a meta search engine to find the parts.

This is simply vandalism (0, Flamebait)

hqm (49964) | more than 7 years ago | (#13871279)

Someone sets up a nice public service, and some asshole has to come along to abuse it. This isn't clever, it's no different from any other act of mindless vandalism. Society is held together by an implicit contract that people not act like selfish pigs. The guy who releases this software is a selfish pig.

Re:This is simply vandalism (1)

slim (1652) | more than 7 years ago | (#13871561)

Read the presentation and the FAQ. He's done his best to demonstrate the point without (his words) "being a dick".

What does PHP have to do with it (2, Interesting)

PktLoss (647983) | more than 7 years ago | (#13871302)

Yes, I RTFA, and looked at how things work, the fact that PHP is being used is immaterial.

The basic functionality of TinyURL, NanoURL or any other service is to accept a string (presumably a URI) and return a shorter string that will serve as a pointer to it. If you want your application to accomplish that it doesn't matter what it was written in, people can store things other than URLs in your database. The protections against this sort of use/abuse suggested in the article are also language independent.

Greatest FAQ answer ever. (5, Funny)

jdludlow (316515) | more than 7 years ago | (#13871373)

From the TinyDisk FAQ:

Q: This damn thing doesn't work on large files! #@%& You!
A: Did you not read the manual? Man I wish I could punch you in the face over TCP/IP! Change the config file's MaxSize line. By default the limit is 2 megs.

TinyDi...... (0)

Anonymous Coward | more than 7 years ago | (#13871624)

oooooh TinyDISK..... nevermind
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...