Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.<p>It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?<p>You might as well call it Exploit Pro Max...
The author clearly used super intelligence.
Feels like the goal was sensationalism.
I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaces. ... and of course we still have to expose gzip to attack as well.<p>Every time you add something you lose something...
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately.
Guess that's just how it's gonna be from now on.
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.<p>Who turned on hard mode this week?
Brotli2Shell seems to be a more appropriate name for this.
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
wtf Python is also effected. <a href="https://pypi.org/project/brotli/" rel="nofollow">https://pypi.org/project/brotli/</a> not sure about shell
Side point from going to pypi:<p>> Security notice: Upgrade certifi, pip, and uv in response to CA certificate incident<p>Blimey PIP is affected? That's bad. I feel like that should have been bigger news?
[flagged]