Hosting files in url minifiers | Hacker News Reader

Hosting files in url minifiers

fulmicoton.com

34 pointsmerrier29 comments

Open articleView on HN

Reminds me of [itty.bitty.site](https://itty.bitty.site/#About/XQAAAAI9BwAAAAAAAAAeHMqHyTY4P...)

There are many places where you can store infinite data "in the cracks" so to speak.

Someone created a wiki-based filesystem that stored data as random wiki pages (wikipedia and other wikis).

They automated account creation, and then created pages with large chunks of base64 encoded encrypted content.

Doing this stuff doesn't make you clever, it just makes you an asshole.

There are also places where you can store large amounts of data for free, not even in the cracks.

For example, dockerhub lets you upload large bundles of data (gigabytes of data with no issue) for free. It's s3 backed, so effectively it's free s3 storage.

Image storage sites, like imgur, let you upload tons of images, and you could easily store data steganographically (edit, typo fixed).

In the early days of Gmail people were building tools to take advantage of this and expose Gmail to your computer as a filesystem:

http://www.viksoe.dk/code/gmail.htm

Google Drive, for example, re-encodes in place every video file you upload (!). So I wouldn't be surprised if imgur was doing something similar to combat steganography.

So... you're saying in addition to free storage, I get free computation resources, too?

Do they re-encode PDFs too? (I don't use Google Drive) PDFs are a funny file format where you can do some crazy stuff... see here for examples: https://www.alchemistowl.org/pocorgtfo/ (click one of the "spoiler" links)

I didn’t know that and that’s kinda annoying. It’s my storage space (which they provide to me for the price my company pays) I should get to fill that with any arbitrary bytes. Why if I stenographically store data as a mpeg that i lose it but if I rename the file .binary i get to keep the data?

Well, you could give them really annoying video formats that they don’t have hardware decoding for…

I mean, in the case of google drive you could also just upload .tar.gz files containing whatever.

It's not like google drive only lets you upload videos.

I wont believe that. Can you show some proof?

Did somebody say: steganography?

https://en.wikipedia.org/wiki/Steganography

I heard about someone circumventing disk quota by encoding the data in the file names, having only empty files.

Could be a different story, but I have this vague recollection of someone who, by taking advantage of sloppy wording, won a bet against someone else who said he couldn't compress random data.

This was a long time ago, maybe as long as twenty years ago. I'd love to find it again, though.

Do you mean this - [1]? Yes, this was pretty cool! I esp liked how Mike, the person initiating the bet, initially was super-confident he'd win:

It would be very easy to point out to him the impossibility of his task, but far more interesting to see how long he will struggle with the problem before realizing it for himself.

[1] http://www.patrickcraig.co.uk/other/compression.php

Yes, that's it. Thanks, and thanks too to pianom4n.

And, yeah, Mike ought to have paid.

Sounds like this one:

https://news.ycombinator.com/item?id=9163782

Neat! Do filesystems not have a limit on maximum name length?

Yeah, they do, usually around 2^8 to 2^15 characters total. Assuming < 256 chars is usually safe, but check the docs for your OS + filesystem combo.

Most filesystems have a limit on the filename of one element, but many don't have a limit on the depth of directories or the total length of the full path to the file. Some operating systems do have a limit on the length of a fully qualified file name, but you may be able to avoid that by only using relative names.

Windows routinely shows me error if I try to rename/delete/move a file, whose name is within the limit, but the complete path from root including all the folders make it above the limit.

I made https://spectre-writer.herokuapp.com to let people store text forever online for free. source here https://github.com/wilsonrocks/spectre-writer fwiw

Similarly, I made this a few years ago, initially meant to show more info on mouseover in a 140-char tweet: because.a.tweet.doesnt.fit.lucb1e.com

More info using itself as demo: http://because.a.tweet.doesnt.fit.lucb1e.com/?text=Useful+fo....

Your service badly needs `<meta charset=utf-8>`.

Ah, I usually add that but apparently forgot, thanks for the tip!

Reminds me of being able to store files in DNS.

https://blog.benjojo.co.uk/post/dns-filesystem-true-cloud-st...

Reminded me of this: https://ralsina.me/weblog/posts/locche-the-untouchable-paste...

> One can really store 4KB of arbitrary data with a url minifier system and share it for free.

Free for you, not free for the minifier service.

That's like saying "One day while I was at Chick-Fil-A I had an epiphany while putting honey on my biscuit. I thought: 'Chick-Fil-A is really nice to provide all this honey for free.' And then it struck me... One can really take all the honey they want and use it to refill their bottles at home one honey packet at a time."

If you think your getting some great deal by going into fast food places and taking all the packets of condiments you can get then your playing yourself. That food chain already won by getting your feet in there. I doubt these companies fret of such things including the url minifier service.

Doesn't mean that said companies are OK with this. The difference is scale. Companies don't care until these tactics get popular enough to affect the bottom line. Chick-fil-a doesn't care about the honey because the "hack" isn't popular and hasn't been done at scale (yet). If it does get popular, you can bet that it will get banned.

See also: Salad towers in China https://kotaku.com/how-chinese-ingenuity-destroyed-salad-bar...

Reply on news.ycombinator.com