> So, do we need to change our file uploaders and whatnot to autokill after a certain amount of time? Or just set `ulimit -m` or whatever judiciously?

Most image formats specify the size before providing any data, you can just check that w*h is below whatever limit you deem fit before loading the image data. The file upload size should already have a "sane" limit so people don't upload truckloads of data, the problem with compression bomb is that you can upload a very small amount of data and it eats the target's RAM on decoding.

> This looks like an annoying attack vector for people that, say, resize image uploads to make thumbnails.

It is, although for JPEG you don't need to decode the image to resize it (depending how whatever you're using is implemented it may still do so regardless).