The original example uses 9 levels of 10 expansions in each level to expand the string lol to a string of 3 * 10 9 bytes, hence the name "billion laughs". The resulting string occupies 3 GB (2.79 GiB) of memory; intermediate strings require additional memory. Because most parsers don't cache the intermediate step for every expansion it is repeated over and over again. It increases the CPU load even more.
An XML document of just a few hundred bytes can disrupt all services on a machine within seconds.

Example XML:

<!DOCTYPE xmlbomb [
<!ENTITY a "1234567890" >
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;">
]>
<bomb>&d;</bomb>

quadratic blowup entity expansion

A quadratic blowup attack is similar to a Billion Laughs attack; it abuses entity expansion, too. Instead of nested entities it repeats one large entity with a couple of thousand chars over and over again. The attack isn't as efficient as the exponential case but it avoids triggering countermeasures of parsers against heavily nested entities. Some parsers limit the depth and breadth of a single entity but not the total amount of expanded text throughout an entire XML document.
A medium-sized XML document with a couple of hundred kilobytes can require a couple of hundred MB to several GB of memory. When the attack is combined with some level of nested expansion an attacker is able to achieve a higher ratio of success.

<!DOCTYPE bomb [
<!ENTITY a "xxxxxxx... a couple of ten thousand chars">
]>
<bomb>&a;&a;&a;... repeat</bomb>

external entity expansion (remote)

Entity declarations can contain more than just text for replacement. They can also point to external resources by public identifiers or system identifiers. System identifiers are standard URIs. When the URI is a URL (e.g. a http:// locator) some parsers download the resource from the remote location and embed them into the XML document verbatim.
Simple example of a parsed external entity:

<!DOCTYPE external [
<!ENTITY ee SYSTEM "http://www.python.org/some.xml">
]>
<root>&ee;</root>

Show HN: A whiteboard that writes math equations
Article, Comments

Looking for where to deploy your AI products for free? Checkout

https://www.restack.io/pricing
They have a no credit card with a free 30USD free compute to get u started.

#AI #Deployment

New video of Reachy 2 by France-based Pollen Robotics shows it performing teleoperated high-precision tasks.

The beta version of the bot with open-source ecosystem launches next month.

Prices: $75K for the full robot with a mobile base; $38K for a stationary one-armed model.

Characters that can be represented as a sum of a perfect range

print(b" ".join([chr(sum(range(i))).encode(errors="ignore") for i in range(1000)]).decode(errors="ignore"))

credits: davide

What have students made using Unreal Engine?

Using everything from Unreal Engine and MetaHuman to RealityCapture and Quixel Megascans, these projects are a showcase of what’s possible with a little imagination and the Epic ecosystem!

This video gives you a glimpse at some of the stunning work produced by our talented community of students in 2024 📚

These are not some company-sponsored games, these are games made by university students around the world.

Randomness is extremely important for secure encryption. Each new key that a computer uses to encrypt data must be truly random, so that an attacker won't be able to figure out the key and decrypt the data. However, computers are designed to provide predictable, logical outputs based on a given input. They aren't designed to produce the random data needed for creating unpredictable encryption keys.

https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/

WhatWeb identifies websites. Its goal is to answer the question, "What is that Website?". WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

GitHub: https://github.com/urbanadventurer/whatweb
Live: https://www.whatweb.net/

Things we wish we didn't know.

https://immich.app/cursed-knowledge/

Long passwords are cursed:
The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored.

JavaScript Data objects are cursed:
JavaScript date objects are 1 indexed for years and days, but 0 indexed for months.

WonderWorld: Interactive 3D Scene Generation from a Single Image
Article, Comments

https://github.com/KovenYu/WonderWorld

Here's an opensource alternative of cursor i honestly think is gonna be a game changer since u can use ollama(locally hosted AI) to do ur AI shinanigans.

https://voideditor.com/

#opensource #alternative

GitHub Notification Emails Hijacked to Send Malware

#Lumma

P.S: Lumma is one of many malware operations (read: gangs) that offer a "malware as a service" product. Their so-called "stealer" code searches through your system for cryptocurrency wallets, stored credentials, and other sensitive data. This data is then sent to their command-and-control (C2) servers where the gang can then move on to either stealing money from you, or profit from selling your data online.