Slashdot Mirror

← Back to Stories (view on slashdot.org)

TinyDisk, A File System on Someone Else's Web App

Posted by ScuttleMonkey on from the all-your-byte-are-belong-to-us dept.

Psy writes "I attended Phreaknic this weekend where Acidus released TinyDisk, a shared file system that runs on top of TinyURL or his own implementation NanoURL. TinyDisk compresses a file, encrypts it, and dices it into clusters. Each cluster is submitted to TinyURL as if it were a url. This clusters can be read back out of the database, making TinyDisk a global file system anyone can use. There are safeguards in the default config to prevent people from dumping gigs of MP3s into TinyURL. While file-system-on-web-applications are nothing new (GMail file system anyone?) this hack shows how easy it is to accidentally design a web application insecurely despite the default PHP protections. See his presentation for more info"

2 of 188 comments (clear)

  1. Insecure? Really? by Afty0r · · Score: 5, Insightful
    this hack shows how easy it is to accidentally design a web application insecurely despite the default PHP protections.
    The design of these TinyURL style applications is insecure in the same way as a concrete wall is insecure because someone could spray paint on it.

    Insecure? Rancid tabloid hyperbole more like.
  2. Re:Nifty hack, or antisocial behavior? by Anonymous Coward · · Score: 5, Insightful

    It is a nifty hack, but let's not kid ourselves and pretend this is anything new, or that it's even a good thing.

    At its core, Tinyurl is just a write-once database. You add data and get back a key/pointer to said data. As with typical databases, the size of the pointer is logarithmic in the size of the input (* number of keys stored, not bytes; however, the number of bytes/key is bounded under some constant, so it's effectively the number of bytes).

    This gives us a logarithmic compression scheme, where our compression ratio (N-logN)/N approaches 100% as N gets large. This kind of "infinite compression" is what makes the method attractive: you put in say a kilobyte of data and get out a (currently) 5 byte key. All you have to do is keep an index of the keys.

    TinyDisk doesn't seem to do this, but you could then turn around and store the index as a key. Take 1000/5 = 200 keys and get back one key. Lather. Rinse. Repeat. In the end, you have a single key that points to the backup of your mp3 collection, all in one TinyUrl! Not too shabby. After all, it's free storage, right? Wrong. Someone ends up paying for the infinite compression. In this case, it's Tinyurl. If this kid had stopped to think for a few minutes before publishing his hack, he would have realized that he's actually doing a malicious, antisocial thing. I suspect there will be a dozen copycats in the wild before the end of the day.

    Farewell TinyUrl, we knew ye well.