本文基于《我使用 Zip Bombs 来保护我的服务器 — I use Zip Bombs to Protect my Server》整理核心信息，并结合实际工程场景给出可执行建议。
核心摘要
- The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bots crawling content to power LLMs. But then there are the malicious bots. These are from spammers, content scrapers or hackers. At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server. It then turned the machine into a botnet used for DDOS. One of my first websites was yanked off of Google search entirely due to bots generating spam. At some point, I had to find a way to protect myself from these bots. That’s when I started using zip bombs.
- A zip bomb is a relatively small compressed file that can expand into a very large file that can overwhelm a machine.
- A feature that was developed early on the web was compression with gzip. The Internet being slow and information being dense, the idea was to compress data as small as possible before transmitting it through the wire. So an 50 KB HTML file, composed of text, can be compressed to 10K, thus saving you 40KB in transmission. On dial up Internet, this meant downloading the page in 3 seconds instead of 12 seconds.
- This same compression can be used to serve CSS, Javascript, or even images. Gzip is fast, simple and drastically improves the browsing experience. When a browser makes a web request, it includes the headers that signals the target server that it can support compression. And if the server also supports it, it will return a compressed version of the expected data.
我的判断
这类内容的共同点是：模型能力上限不断提高，但稳定产出仍取决于流程约束。把验收标准、上下文边界、回归测试写清楚，实际收益会明显高于“追最新模型”。
真正有复利的做法不是一次性写出完美提示词，而是形成可复用的协作脚手架：任务拆解模板、失败回喂模板、以及固定的验证清单。
可直接落地的做法
- 先写可判定的完成标准（测试通过、接口契约、输出格式），再让模型实现。
- 每轮迭代只改一个维度（正确性/可读性/性能），避免目标漂移。
- 把失败案例沉淀为检查清单，下次直接复用。
结语
技术文章真正的价值不在“看过”，而在“转化为下一次决策时可复用的方法”。建议把本文结论映射到你当前项目的一项具体动作，并在一周内验证效果。