Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately.
Guess that's just how it's gonna be from now on.
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaced. ... and of course we still have to expose gzip to attack as well.
Every time you add something you lose something...
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
The author clearly used super intelligence.
Feels like the goal was sensationalism.
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately. Guess that's just how it's gonna be from now on.
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaced. ... and of course we still have to expose gzip to attack as well.
Every time you add something you lose something...
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.
Who turned on hard mode this week?
Nah man. We were on casual mode all along. This is the new normal.
Brotli2Shell seems to be a more appropriate name for this.
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
Because these applications were created long before Rust existed.
There is a cost to conversion.
Brotil was actually created post rust, but before rust took off.
It's not even an application it's a compression library
wtf Python is also effected. https://pypi.org/project/brotli/ not sure about shell
Side point from going to pypi:
> Security notice: Upgrade certifi, pip, and uv in response to CA certificate incident
Blimey PIP is affected? That's bad. I feel like that should have been bigger news?
Pretty sure that's the eMudhra "private key is 4" issue.