Some old technical pages are useful because they document forgotten hardware.
Others calmly explain how to turn 10 megabytes into 281 terabytes.
David Fifield published “A better zip bomb” in July 2019 and kept updating the page afterward. The important trick is that this is not the familiar recursive ZIP bomb built from archives nested inside archives.
Fifield’s construction overlaps files inside the ZIP container so many output files can refer back to the same compressed data. The result expands in a single decompression pass and can reach a compression ratio above 28 million to one.
At the limits of the ordinary ZIP format, the example grows from roughly 10 MB to 281 TB. With 64-bit ZIP extensions, the numbers get even more absurd.
The page includes the explanation, source code, sample archives, diagrams, technical notes and later corrections. It became a proper security paper at the 2019 USENIX Workshop on Offensive Technologies, where it won Best Paper.
The web page is the lab notebook
What makes the BamSoftware version worth keeping is not merely the headline number.
The HTML page is a research artifact.
It shows the reasoning, links the implementation, records updates by date and leaves enough detail for another technical reader to understand what is actually happening inside ZIP and DEFLATE rather than repeating “compression bomb bad” from a security glossary.
That kind of page used to be common on the technical web. Somebody found something strange, wrote the whole thing down, published the code and kept the original URL alive.
There is also an important distinction here: the classic 42.zip depends on recursive unpacking for its ridiculous expansion. Fifield’s design specifically tries to remove that requirement. That is why the work was interesting enough to become a conference paper instead of another malware anecdote.
CacheRat’s 1,967 Ancient Web Domains research list exists for exactly this kind of technical rabbit hole: a compact page that contains far more useful information than its visual footprint suggests.
The modern web has no shortage of security explainers.
Very few of them hand you the bomb diagram, the source code and the math.