1
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
Mike Cardwell
Mike Love's blog on Linux, security, and privacy — tutorials, analysis, and tools
- Popular posts
- 6
- Total points
- 765
- HN comments
- 516
- Rank
- #3,062 personal
Visit grepular.com → RSS feedOn Hacker News Jan 2011 – Mar 2026
Security & Privacy 6Web & Frontend 4Tools & Productivity 1Networking & Internet 1
2
Neat trick for getting private info for Facebook, GMail, Twitter and Digg users
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
3
Protecting a Laptop from Simple and Sophisticated Attacks
How I secured a ThinkPad: a Windows honeypot with Prey for thieves, TRESOR against cold boot, a USB boot stick for evil maids, and a separate Firefox user.
4
Cert Authorities Check for DNSSEC from Today
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
5
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
6
The Sad State of HTML Email Input Fields and IDNs
Chrome and Firefox disagree on IDN addresses in type=email inputs: punycode, validity and the value JavaScript sees. Feature detection is the workaround.