YHK - yet another hacker news clone

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

35 points theanonymousone 3 hours ago 17 comments

est 1 hour ago | parent

wtf Python is also effected. https://pypi.org/project/brotli/ not sure about shell

Incipient 24 minutes ago | parent

Side point from going to pypi:

> Security notice: Upgrade certifi, pip, and uv in response to CA certificate incident

Blimey PIP is affected? That's bad. I feel like that should have been bigger news?

murderfs 14 minutes ago | parent

Pretty sure that's the eMudhra "private key is 4" issue.

tetha 1 hour ago | parent

Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.

Who turned on hard mode this week?

loloquwowndueo 28 minutes ago | parent

Nah man. We were on casual mode all along. This is the new normal.

netsharc 52 minutes ago | parent

Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.

It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?

You might as well call it Exploit Pro Max...

CharlieDigital 47 minutes ago | parent

Feels like the goal was sensationalism.

reddozen 14 minutes ago | parent

The author clearly used super intelligence.

techpression 4 minutes ago | parent

I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.

davedx 33 minutes ago | parent

Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?

doublerabbit 30 minutes ago | parent

Because these applications were created long before Rust existed.

There is a cost to conversion.

Gigachad 29 minutes ago | parent

Brotil was actually created post rust, but before rust took off.

davedx 24 minutes ago | parent

It's not even an application it's a compression library

nairboon 26 minutes ago | parent

Brotli2Shell seems to be a more appropriate name for this.

cowsandmilk 24 minutes ago | parent

Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.

flyingjoe 18 minutes ago | parent

A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately. Guess that's just how it's gonna be from now on.

upofadown 14 minutes ago | parent

An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaced. ... and of course we still have to expose gzip to attack as well.

Every time you add something you lose something...