Microsoft's Skydrive sends two million NULL characters

http://my.opera.com/hallvors/blog/2012/11/12/microsoft-sends-two-million-null-characters-hangs-opera

by franze • 14 years ago

201 115 14 years ago

my.opera.com

andrewcooke3• 14 years ago

is it actually sending 2M characters over the wire (ie uncompressed)? you could imagine seeing something like this via a glitch in compression (2 million of anything, run length encoded, doesn't take much space).

(i guess it's also possible that this really is 2M nulls at a lower level and compression just happens to save you from an embarrassing waste of bandwidth).

it's not clear to me what the URL is to check myself.

gingerlime2• 14 years ago

I was thinking the same thing. Is the content gzip'd on the server? This could be a nice (i.e. evil) way to send a very small response to the browser that would pretty much kill it.

a slightly more evil version would be to perhaps do:

  var x="...2 billion of the same character...";

This should compress very well to gzip, but will likely to exhaust the browser's memory (??)

rcxdude• 14 years ago

Indeed, there was a 'crash your browser' webpage a few months ago which used this technique I think. Unfortunatly I can't find it currently.

olliesaunders• 14 years ago

This is very similar to the ping of death that requests a undeliverably big ping response.

samwillis• 14 years ago

You are describing a zip/decompression bomb. Most zip and compression libs protect against them.

http://en.wikipedia.org/wiki/Zip_bomb

VMG• 14 years ago

The easier version would be to just run a crashing script

    var i = 1, a = []; while(a[i++] = "a" + a);

takluyver• 14 years ago

I think most HTTP these days uses transparent compression, but I can't find a source for that just now.

brudgers2• 14 years ago

The author's choice of title somewhat implies malfeasance on Microsoft's part. In general, the article seems intended to spread FUD regarding Skydrive.

I would point out that if Opera is just now debugging their interaction with Skydrive, it is indicative of how few people use it. While I appreciate the motivations behind it and its rich feature set, I gave up on Opera for Firefox after a year. In part this was the fatigue of experiencing broken websites, in part because of low quality plugins comparable to noscript.

Opera would be great if it handled nonstandard html gracefully for me instead of telling me about its high horse and the shoddiness of the websites I use.

mikeash4• 14 years ago

Where's the FUD? The tone of the article is fairly strictly factual. The only deviation from facts is where he says that it's bizarre to encounter this, which is an opinion, but still completely reasonable. IMO it is bizarre.

rplnt6• 14 years ago

> I gave up on Opera for Firefox after a year

And went to use what? IE? Or did you try Opera/FF just recently when Chrome became usable?

hallvors2• 14 years ago

Skydrive's main page worked fine in Opera last week, I assume an update caused this. I've made many stupid mistakes myself (sometimes very public ones - http://my.opera.com/hallvors/blog/2012/08/04/bumpy-road-to-o... ), so I have no intention of implying malfeasance or spreading FUD about Skydrive. It is however a surprising and amusing error, hopefully soon fixed.

hoppipolla2• 14 years ago

> Opera would be great if it handled nonstandard html gracefully for me

We put a huge amount of effort into handling "nonstandard" html, including fixing the standards so that they represent the reality of what browsers have to handle.

In this case our failure is clearly a bug that we should fix. I don't think anyone disputes that.

In general, site-compatibility is a hard problem. People often depend – intentionally or not – on the specific behaviour of particular browsers. When this causes sites to break in Opera we try to analyse the breakage and adopt some strategy to fix it. Hallvord is one of the people responsible for this and, if you read his blog you'll see that it's not a trivial undertaking; pinpointing an error in tens of thousands of lines of closure-compiled, minified JS makes for an interesting challenge, for example.

If we find the problem's a bug in Opera we obviously try to fix that bug. If it is the site doing something broken we typically try to contact the site owner to get it fixed. In either case we may also try using our browser.js system to make a short-term "sitepatch"; a hack using a combination of UA string manipulation, javascript and CSS that changes the behaviour for a specific site and which can be rapidly deployed. In this instance sitepatching likely isn't reasonable, so we will have to work to find the solution that will unbreak the site as quickly as practical.

pbhjpbhj• 14 years ago

>Opera would be great if it handled nonstandard html gracefully for me instead of telling me about its high horse and the shoddiness of the websites I use. //

I find it hard to see how you think this is Opera's fault. MS send their browser different, non-standards compliant, content that includes 2M of null characters. Yes Opera can modify to correct their handling of MS's disastrous abuse of the web but you can't exactly blame Opera.

>if Opera is just now debugging their interaction with Skydrive //

I'm sure MS won't amend it in any non-standards compliant way without notifying the other major browser makers and giving them a suitable implementation period; they'll surely keep all interactions well documented too. /s

mikeash4• 14 years ago

Exactly what I was thinking. My best guess is that their data is triggering a latent bug in their gzip compressor which causes it to output something that decompresses to 2MB of zeroes.

CJefferson• 14 years ago

Just to save anyone else bothering to check, 2M of nulls gzips to almost exactly 2k. Easy to imagine with compression how you could miss that, although it is still a bit embarrassing.

pilif• 14 years ago

while it's certainly not a very good example of good network citizenship to send 2 megs of NULL bytes, I think Opera shouldn't be crashing here. The fact that it does points to a bug in the code that might potentially be exploitable beyond the simple denial of service which it already is.

AFAIK Opera still runs all tabs in one shared process, so spamming one tab with 2MB of NULL will cause the whole browser (and with it all other tabs) to crash.

pygy_• 14 years ago

Your point is actually acknowledged by the author of the post.

ygra6• 14 years ago

They said so in the post: “We should fix that”.

There are other browsers out there that have the same problem regarding tabs, namely Firefox. A misbehaving tab causes the whole browser to stall and you can't even kill that single tab. So Opera isn't alone in that regard.

ricardobeat• 14 years ago

I thought Firefox had already isolated tab processes a couple releases ago?

Tyrant505• 14 years ago

aside from Chrome, do ANY other browsers handle tabs separately?

notimetorelax• 14 years ago

Even Chrome reuses processes for child tabs. As far as I remember it is done to allow JavaScript to access child window from parent.

kevingadd• 14 years ago

Internet Explorer has some degree of tab separation. I'm not sure if it's processes or threads, but it can recover a crashed tab.

shin_lao• 14 years ago

Internet Explorer, since version 8, has one process per tab.

Tomis025• 14 years ago

Right now I have 101 tabs running, and only 6 cores in my CPU. Do you know how much context switching costs in terms of performance? Do you know what the overhead would be if I were using Chrome?

So spare me, please. When general purpose computing moves to GPUs then we'll revisit the idea of "one tab per process". Until then, out of "Chrome, many tabs, performance", pick any two, drop the other.

LockeWatts2• 14 years ago

That sounds like a personal problem. Your brain can't possibly handle anywhere near the amount of information 101 tabs provides at once, there's no reason to do that.

Jare• 14 years ago

> Do you know how much context switching costs in terms of performance?

How much do you think? Most of your 101 tabs should be idle, not active, so my guess would be "not much".

Freaky• 14 years ago

Context switching isn't that big a deal, it's actually pretty good for responsiveness since everything isn't being serialised through a single thread. Compare/contrast animgifs on a busy Opera vs a busy Chrome - Opera will regularly freeze momentarily, presumably because of stop-the-world GC.

The bigger problem is having that many tabs open without burning through enormous amounts of memory. Chrome's at least 10x less memory-efficient than Opera in this regard, which isn't great when my Opera sessions regularly run to well over 4GB :)

why-el• 14 years ago

I do something similar. If I am to open too many tabs and don't really need the dev tools, i.e. doing some casual browsing, I go for Opera, or Firefox instead of Chrome. I also go for them when travelling and the battery is scarce.

mccr8• 14 years ago

I believe that Chrome caps the number of processes that it uses, so you wouldn't actually be using 101 processes. I think it caps at something like 8, or did when Chrome first came out.

at-fates-hands• 14 years ago

>>>>Right now I have 101 tabs running

Dude, I get claustrophobic if I have more than 4 or 5 tabs open. Dare I ask why you have 100 tabs open?

lallysingh• 14 years ago

The context switch itself is almost trivial at that scale -- a couple hundred ns per switch, with the occurrence interval in the 10s-100s of milliseconds, depending on the CPU scheduler. The part that hurts is all the cache invalidation. Unless you're actually swapping. Then you're really hosed.

Well, that and any particularly nasty plugins (cough flash cough) that don't like many instances at once.

Which OS are you running? I have yet to see chrome on linux have any hiccups on as many tabs as I throw at it. The only time I've seen hiccups are when the X server's busy on something else or I'm short on memory.

If you're on another OS, perhaps chrome's suffering b/c it can't share GDI resources (or mac's equiv) across tabs? I'm assuming it can't, as each tab's got a different process ID.

Evbn2• 14 years ago

Context switching costs far less than the time it takes you to press the key to switch between tabs, and is not appreciably more expensive for a process than for a thread.

chj• 14 years ago

If I were opera, I would quietly suck it up. This is more of their own fault. Even if someone sends you 20M of NUL, you should not crash.

robbles• 14 years ago

It's not very hard to crash a browser or browser tab. There's a certain point where all situations can't be reasonably handled by the browser, and it makes more sense to crash when something unexpected happens.

Here's an example I posted a while back of how to crash most major browsers with a link: http://blog.doteight.com/blog/2011/08/24/this-link-will-cras...

* Just checked, it only seems to work with Chrome these days. I guess the other browsers have figured that one out.

evincarofautumn• 14 years ago

A friend of mine who uses SharePoint at work has mentioned its peculiar habit of occasionally inserting “millions of whitespace characters” in source files. Perhaps this is related.

bibinou2• 14 years ago

A post-mortem after this bug is fixed would be interesting, I don't see how 2MB of NULL characters should be different from a random <img>.

laumars2• 14 years ago

A random embedded image wouldn't be passed through the HTML parser (at least not if the web server has it's MIMEs set up correctly - and if they don't, then the site would be considerably less usable).

It will be interesting to see the results though - to see if the null characters even reach that far or if this is effectively hitting Opera with a zip-bomb

anonymfus• 14 years ago

data: URLs?

bibinou2• 14 years ago

this reminded me of `A file that's both an acceptable HTML page and a JPEG (view source on it)` : http://news.ycombinator.com/item?id=4209052

mephi5t0• 14 years ago

Somebody fall asleep on the keyboard right after the if(userAgent == Opera) :)

dbaupp• 14 years ago

It shows up in Firefox too.

meritt• 14 years ago

Maybe they are just trying to locate a faulty router that always sets certain bits to 1 above a certain MTU size.

imrehg• 14 years ago

Well played....

(or for those who missed and like epic networking related fun http://news.ycombinator.com/item?id=4709438 )

DanBC• 14 years ago

A bit of noodling shows people having this (or something similar) in 2009.

(http://social.msdn.microsoft.com/Forums/en-US/sharepointcust...)

195,000 blank lines? Oh you kidder, Microsoft! (https://padavis.wordpress.com/2009/05/07/sharepoint-designer...)

chiph• 14 years ago

Does the mobile version of Skydrive do this too?

"I don't understand how I could have hit my wireless cap again?!?"

jrockway• 14 years ago

The most interesting part of the article is that the author uses Comic Sans as the font in his text editor.

hallvors2• 14 years ago

Comic relief :)

benmmurphy3• 14 years ago

2MB of null could be a bug somewhere with compression or decompression

benmmurphy3• 14 years ago

just to test this theory I used tamper data with firefox to remove the Accept-Encoding header and I received ~ 100kb page back and with the Accept-Encoding header present I received ~ 30 kb page but the 30 kb page also had the 2 million null characters. I assume microsoft has a bug in their gzip library or possibly firefox/opera have a bug in theirs.

andrewcooke3• 14 years ago

are you the original author? what url are you using taht shows the null characters?

ww520• 14 years ago

Is it the Skydrive website sending 2Meg 0's? Or the Skydrive software itself? That's a big difference. It sounds like the website's sending 2Meg of 0's in a webpage. Webpages are compressed usually when sent across wire so the 2Meg of 0's is really nothing.

hybrid11• 14 years ago

People still use Opera?

ehosca• 14 years ago

2M null characters is just a few bytes when zipped... this smells like a screwed up server config...

Microsoft's Skydrive sends two million NULL characters

Related Stories