Hacker News new | past | comments | ask | show | jobs | submit login

Fascinating... I wonder how many .zip files in the wild have this issue and if perhaps as a result many unarchiving applications tolerate it.



I exploited this once when designing a puzzle. One clue was "encrypted" text appended to the end of an otherwise-innocent zip file.

(One person found it, but the whole thing was way too hard. I drastically overestimated people's operational cleverness.)


> I drastically overestimated people's operational cleverness.

Maybe your target audience was just not quite right? People go gaga over ARGs and devote thousands of hours to 'em.

Maybe hint that your game has something to do with HalfLife 3...


> Maybe your target audience was just not quite right?

Nah. It's insanely difficult to find this kind of stuff when you have no clue what to look for.


I'm actually surprised yauzl can get away with rejecting .zip files due to appended data. I recall that back in the BBS days downloaded files frequently had trailing bytes on them (perhaps padding to block size, or something?).


You're making me seem old I guess, but I've encountered this a bunch of times. This was often done as a way to add metadata to things that otherwise didn't have metadata or needed additional info. Typical use cases include music players, trackers, drawing programs, media viewers, and anything that scanned files for metadata (ex: BBS).

The SAUCE spec adds trailing bytes after the EOF mark for instance. I wrote a few SAUCE reader/writers embedded in various codebases (and will release a stand-alone good one some day soon).

Generally, a trick was that if you wanted some sort of metadata on a file, you could add it before the contents of the file (as in MKV allows ASCII at the start) or after the EOF marker. The latter made sure you didn't interfere with a lot of existing programs on various operating systems of the time, including but not limited to DOS, Windows, and CP/M. This trick still works for a lot of OSs or in other forms today, we just don't rely on markers for EOF as much so there are other methods, and people have started to bake metadata into specs.

As for the BBS scene, although SAUCE was used, for zips DIZ tended to be used more and was just packed into the archive and could be found using the internal TOC, or otherwise just uploaded separately.



CP/M didn't record the file size, so all files were a multiple of 128 bytes. The Ctrl-Z convention to mark the end of a text file came from this restriction, and that convention is still used by Windows today.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: