Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps (aikido.dev)
33 points by theanonymousone 4 hours ago
netsharc an hour ago
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
reddozen 10 minutes ago
The author clearly used super intelligence.
CharlieDigital 43 minutes ago
Feels like the goal was sensationalism.
flyingjoe 14 minutes ago
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately. Guess that's just how it's gonna be from now on.
upofadown 10 minutes ago
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaced. ... and of course we still have to expose gzip to attack as well.
Every time you add something you lose something...
cowsandmilk 20 minutes ago
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
tetha an hour ago
Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.
Who turned on hard mode this week?
loloquwowndueo 24 minutes ago
Nah man. We were on casual mode all along. This is the new normal.
nairboon 22 minutes ago
Brotli2Shell seems to be a more appropriate name for this.
davedx 29 minutes ago
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
doublerabbit 26 minutes ago
Because these applications were created long before Rust existed.
There is a cost to conversion.
Gigachad 25 minutes ago
Brotil was actually created post rust, but before rust took off.
davedx 20 minutes ago
It's not even an application it's a compression library
est an hour ago
wtf Python is also effected. https://pypi.org/project/brotli/ not sure about shell
Incipient 20 minutes ago
Side point from going to pypi:
> Security notice: Upgrade certifi, pip, and uv in response to CA certificate incident
Blimey PIP is affected? That's bad. I feel like that should have been bigger news?
murderfs 10 minutes ago
Pretty sure that's the eMudhra "private key is 4" issue.