Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.
AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.
No human reviews anything anymore so of course they aren't going to catch it.
Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"
You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.
Much prefer the Broccoli2Shell name & site (for the same vuln): https://broccoli2shell.com/. For starters, I'm pretty sure you can hit this without HTTP if you do any manual Brotli decoding, HTTP just happens to be the most common case that comes up.
I see some irony here. For a period of time, Google chose not to include JPEG XL in Chrome because vulnerabilities in the library could compromise the software - a legitimate concern. Yet, Google is the author of the Brotli data compression format a decade before the JPEG XL drama, and was happy to use it in Chrome and encourage others to use the library, despite the fact that it also increases the attack surface.
I'm not seeing any source for the claim that OpenAI discovered this in February. The source that the article links (a tweet by OpenAI) doesn't claim that.
To me, the surprising part is how many of these implement brotli compression of request (not just response) bodies, given how obscure a feature that is.
In any case all this sensationalism is starting to get annoying. Patch your stuff and move on.
Edit: actually, between all the sensationalism, its hard to tell from the article how many of these actually support brotli compressed request bodies in common configs vs some other use of brotli (which is bad but nowhere near as critical)
It seems like node supports it with body parser enabled.
But im having trouble finding any docs suggesting anything else supports it on inbound requests.
Obviously there are other scenarios where it is exploitable, but it is a much less severe vuln if the attacker must first force the program to make an outbound request to a server of its chosing rather than just connect to a vulnerable server.
I wonder if we'll see more of this thanks to AI. Extremely complex features that nobody uses and that were easy to add, which incidentally tremendously expand the attack surface. One would hope that maintainer would be wise to avoid that, but for how long?
My experience with Brotli is from back when all the hype was mobile first and India etc was super mobile first so all these social networks lost their mind optimizing for request success and speed. So they were going crazy over micro-wins like that.
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately.
Guess that's just how it's gonna be from now on.
That's why it's important to practice your processes for both shipping quickly and overriding cooldowns. There's a baseline of things which are not easy to exploit where you want to patch on a regular cadence and the risk posed by a supply chain attack is greater than the risk of an attacker having enough of a footprint inside your systems to escalate. The fact that sometimes you have a specific situation like this where that's not true doesn't mean that 9 times out of 10 the cooldown was the better risk-reduction strategy.
Yeah, obviously? Deploy fixes to security issues which apply to you as soon as possible, deploy random feature additions and non-critical bug fixes after some cooldown.
As always, the easiest way to manage this is to have as few dependencies as possible. If you have a lockfile with thousands of entries, you won't be able to go through them and decide which upgrades are legitimate urgent security updates and which can wait. If you have 10? You'll manage.
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Let’s say I have a node.js app behind an Amazon elastic load balancer which terminates TLS. My understanding is that in nearly all configurations, my app would be unaffected because the ELB would handle decompression. Is that generally correct?
I don’t know about that specific software, but I would be surprised if it decoded message bodies, which is entirely unrelated to TLS termination and shouldd be entirely unrelated to routing. So I would expect you would still be vulnerable.
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaces. ... and of course we still have to expose gzip to attack as well.
Every time you add something you lose something...
I had to check all of our Python deployments and installation BOMs and was quite relieved - turns out that none actually installed brotli libraries. HTTP libraries like httpx, requests and frameworks consider them optional and autodetect their presence.
This is yet another example of the incredible negative impact of Google’s pattern of crapping out open-source libraries without actually maintaining them, so that people just copy and paste them into their projects.
So, uh, isn’t the blast radius huge here? Like ticking time bomb for unpatched servers huge once someone figures out how to craft their br payload just right?
Browsers were patched back in March, but if you can get anything else that is unpatched to decode br, and most HTTP clients do by default, and you’ve figured out the right payload (yes not easy, but still), isn’t this, well, really bad? Like Heartbleed big?
git for windows is vulnerable even in its latest release (2.56.0.windows.3), careful pulling repos over https from random ass servers (prolly uncommon but hey). they already merged the fix on the repo, it's just in a snapshot build only; should prolly arrive on Monday (2.56.0.windows.4).
also affects codex (gui), which ships its own git, could be more of a problem there, when the LLMs get quirky at night. still unlikely to be a problem though.
speaking of, update codex (and wipe its cache at ~/.cache/codex-runtimes), ships its own node. update python.
stuff like wireshark and imhex remain vulnerable, even on their latest repo commits, which may or may not be spicy.
also Microsoft 365 Copilot still has its own unpatched brotlidec.dll from Oct 7, if anyone uses that. no fix available for that one afaik, not sure about how it can be made to access the vulnerable decoder.
Because a local software vuln is much less scary, less exploitable, and more common than an exploit like PHP2Shell, which requires basically no effort to exploit a large chunk of publicly exposed webservers. Basically, local vulns have been a thing forever and GP is off topic.
"In 2016, the Brotli algorithm shipped in Chrome, delivering overall better compression ratios for eligible resources."
"By the end of 2017, all modern browsers supported Brotli, and server support for it started to become more widespread."
For www users, all that data collection, surveillance and ad services traffic to enrich so-called "tech" companies acting as intermediaries, can make the www exceedingly slow
The way to "make the web faster" (or less inefficient) is to get rid of that needless traffic, and the ads it supports
SPDY,^1 HTTP/2 Server Push,^2 HTTP/3 QPACK,^3 brotli, .... make www users ("ad targets" to Google) uninformed, nonconsenting subjects in Google's failed experiments
The www already works just fine for its intended purpose (_not_ data collection, surveillance and ad services)
I agree with you, but the immediate problem here seems to be that all major browsers support Brotli, and i think they all use the Google library, so they are all vulnerable.
Most of the discussion here is about vulnerabilities in servers, but it looks like its mostly a client problem.
Is there a way to turn brotli off?
Going back to your point, if we kept things simple we would be a lot more secure.
"OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses."
Every user is different
For me I'm a text-only user not interested in graphics
I do not use a so-called "modern" browser to make HTTP requests
I don't request brotli-compressed content/resources^1
Normally I don't send an Accept-Encoding header
Almost always servers to which I connect^2 will return uncompressed text, which is what I want. No Accept-Encoding header needed
Occasionally servers will send gzip-compressed text by default and will ignore "Accept-Encoding: identity"
However the popular so-called "modern" browsers will send an Accept-Encoding header whose value includes brotli (br) by default
Unsuspecting www users are consequently opted in to Google's brotli experiment. Me, I opt out
1. I use a text-only browser (1.3MB static binary) to read HTML. I compile it without brotli support
2. Other users may connect to different servers. Preferences vary from user to user
I really don't understand how so many different things are affected by the same brotli bug/exploit.
I even read the patch for the C code (patch which, btw, seems a bit hacky to me with isSafe? methods added and whatnots but YMMV: now I understand things had to be patched in a hurry but this patch really looks like "lipstick on a buffer overflowing C pig" to me).
What's the link between Python / Node / C++ / libbrotli / Envoy / Bun: are those some all using the same C brotli encoder/decoder?
Can someone who knows more explain why all those are vulnerable?
> As for unaffected software, Apache’s standard mod_brotli does not decode Brotli
Because this one only encodes and doesn't decode and the bug is in the decoder? (for I take it mod_brotli, with such a name, still does something brotli related and isn't, say, a TOTP token generator nor a SAT solver?).
I mean overall, sheesh: could we get better explanation / better writeups when such big fuckups happen?
Yes. All these language runtimes compile against common libraries. Compression libs are one of the most common common libraries that platforms like node, ruby, dotnet, python, and etc need to compile.
Google provides the Brotli implementation. Package maintainers slurp that up and create ie libbrotli-dev. When you compile node it uses that for brotli support.
Brotli was a library released by the Google team that developed it. There weren't lots of independent implementations; they were all from the same source code.
As I've mentioned numerous times at this point, relying on third party code is a massive liability (supply chain attacks/sloppy code). My hand rolled brotli implementation is not only faster than libbrotli but also immune to this vulnerability (yes, I checked). Roll your own code people.
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
Security is a factor everywhere. And C is everywhere. There's not going to be a "rewrite everything in Rust" project until after there is some legit penalty for selling / offering software in C that could be more secure in another language.
I think Mozilla got it right when they abandoned the effort to rewrite the entire browser in Rust and instead focused on analysis of which modules needed priority rewrites. If a module has historically had zero memory-related bugs, then there are other higher priority things to spend time on.
That said, Google Project Zero should have had Brotli on their radar. Hopefully they still have people and resources.
Why are we still so reliant on HTTP? HTTP came out in 1990 (36 years ago) and the most common version of HTTP still in use, 1.1 (RFC2616), came out in 1999 (27 years ago)?
Yes, I know HTTP 2 and 3 and SSE are attempts to make it faster and more parallel, but its still slow. Its slow because its unidirectional with a full round trip and by default its a new socket per each message. Yes, I know the real reason HTTP became and remains popular is because its sessionless... in theory. Still, there are better options available. You can do so much more with a full duplex channel.
HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.
SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.
For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.
Agreed. The issue with all these archaic standards is that they were rolled decades ago back when certain practices were either outright not being employed OR that hardware wasn't fast enough. Ironically, HTTP itself is a literal nightmare to parse (performance wise) on top of having like... ten? distinct vulnerability classes. The world desperately needs new standards.
Just open a TCP socket and send JSON messages. Or if you want a bit more efficiency, fixed-format binary messages, but remember to include a version number.
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?
(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)
I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.
AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.
No human reviews anything anymore so of course they aren't going to catch it.
Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"
That means that it supports other services with OpenAI-compatible embeddings APIs (not just OpenAI's own API). Seems reasonable!
1 reply →
LLM-based AI is a synthesis of human observed behavior
1 reply →
Descriptive type names are a good thing. Id argue that one isnt that bad, but llms do take it to another level sometimes.
Feels like the goal was sensationalism.
Something that OpenAI would coin. Just like Anthropic did with Mythos.
Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.
I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.
1 reply →
Or EUVD-2026-108169.
Actually it does, if the server is willing to decompress POST bodies.
Brotli bodies, so Brotli2Shell
1 reply →
I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
Specifically Brotli2Shell
3 replies →
The author clearly used super intelligence.
You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.
It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.
Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.
All these names are silly. It's just marketing.
There are levels of silliness, and this has achieved a new one.
Much prefer the Broccoli2Shell name & site (for the same vuln): https://broccoli2shell.com/. For starters, I'm pretty sure you can hit this without HTTP if you do any manual Brotli decoding, HTTP just happens to be the most common case that comes up.
Why do critical vulnerabilities get a cutesy name and website nowadays? Who’s paying for these sites?
This has been the case for more than a decade, Heartbleed was probably the one which really created the trend.
1 reply →
Small static websites are effectively free (Cloudflare, GCP free tier, etc)..
4 replies →
I'm certainly not complaining about some selfless guy making a helpful website without expecting anything in return!
5 replies →
Are you asking why do we name things? In a programming forum?
2 replies →
It is annoying (and ironic) because larger companies, that will benefit from this information the most, blocks newly registered domains.
I see some irony here. For a period of time, Google chose not to include JPEG XL in Chrome because vulnerabilities in the library could compromise the software - a legitimate concern. Yet, Google is the author of the Brotli data compression format a decade before the JPEG XL drama, and was happy to use it in Chrome and encourage others to use the library, despite the fact that it also increases the attack surface.
> reported it as unauthenticated remote code execution that works in both directions
> but it wasn't recognized as a security issue at the time and no release shipped with the fix until now
I'm always getting my dangerous RCE bugs mixed up with my harmless RCE bugs.
I'm curious how this was reported and fixed back in Feb but nobody recognized the importance. A case of AI automation and nobody at the wheel?
I'm not seeing any source for the claim that OpenAI discovered this in February. The source that the article links (a tweet by OpenAI) doesn't claim that.
To me, the surprising part is how many of these implement brotli compression of request (not just response) bodies, given how obscure a feature that is.
In any case all this sensationalism is starting to get annoying. Patch your stuff and move on.
Edit: actually, between all the sensationalism, its hard to tell from the article how many of these actually support brotli compressed request bodies in common configs vs some other use of brotli (which is bad but nowhere near as critical)
I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.
So as a hotfix I block this on my reverse proxy.
But is that actually true?
It seems like node supports it with body parser enabled.
But im having trouble finding any docs suggesting anything else supports it on inbound requests.
Obviously there are other scenarios where it is exploitable, but it is a much less severe vuln if the attacker must first force the program to make an outbound request to a server of its chosing rather than just connect to a vulnerable server.
6 replies →
I wonder if we'll see more of this thanks to AI. Extremely complex features that nobody uses and that were easy to add, which incidentally tremendously expand the attack surface. One would hope that maintainer would be wise to avoid that, but for how long?
4 replies →
Cloudflare has this amazing feature where it accepts compressed payloads and forwards them to unsuspecting backends. Can be weaponized in many ways.
My experience with Brotli is from back when all the hype was mobile first and India etc was super mobile first so all these social networks lost their mind optimizing for request success and speed. So they were going crazy over micro-wins like that.
Brotli2Shell seems to be a more appropriate name for this.
There's this other name for the same vuln: https://broccoli2shell.com/
Not when you're prioritising sensationalism over accuracy. Everyone's heard of HTTP, but hardly anyone's heard of brotli.
call it GoogleBrotli2Shell then.
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately. Guess that's just how it's gonna be from now on.
That's why it's important to practice your processes for both shipping quickly and overriding cooldowns. There's a baseline of things which are not easy to exploit where you want to patch on a regular cadence and the risk posed by a supply chain attack is greater than the risk of an attacker having enough of a footprint inside your systems to escalate. The fact that sometimes you have a specific situation like this where that's not true doesn't mean that 9 times out of 10 the cooldown was the better risk-reduction strategy.
It used to be a flex to say you deploy daily but it’s going to become a necessity just to keep up with the vulns
CI/CD — Continuous Incidents, Continuous Defense.
Yeah, obviously? Deploy fixes to security issues which apply to you as soon as possible, deploy random feature additions and non-critical bug fixes after some cooldown.
As always, the easiest way to manage this is to have as few dependencies as possible. If you have a lockfile with thousands of entries, you won't be able to go through them and decide which upgrades are legitimate urgent security updates and which can wait. If you have 10? You'll manage.
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Yeah that doesn't make a lot of sense that they reported it but also nobody knew it was a security issue..
Maybe an LLM just happened to do one of those "while I'm here" fixes in Feb and because nobody reviews anything anymore..
"Fixed reading too many bytes."
LGTM!
Edit: I was close! "Detect and report invalid stream earlier." Could have been a person.
Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.
Who turned on hard mode this week?
Nah man. We were on casual mode all along. This is the new normal.
Ubuntu still has libbrotli1 patch under review as medium. This is holding up updates to libcurl and thus git and a whole bunch of other stuff.
They’ll have it for few months and then make you pay to get the update.
I've just been pointing a Claude Code at these things as they pop up. A great time to not have to worry about chasing all these things manually.
Let’s say I have a node.js app behind an Amazon elastic load balancer which terminates TLS. My understanding is that in nearly all configurations, my app would be unaffected because the ELB would handle decompression. Is that generally correct?
I don’t know about that specific software, but I would be surprised if it decoded message bodies, which is entirely unrelated to TLS termination and shouldd be entirely unrelated to routing. So I would expect you would still be vulnerable.
Yep, I don't think too many people are exposing their python/node servers directly, it should be always behind a proxy or a fancy cloud LB.
Apache and nginx don't handle brotli out of the box.
[dead]
An example of the cost of added complexity I suppose. Brotli is much more complicated than the gzip/deflate it replaces. ... and of course we still have to expose gzip to attack as well.
Every time you add something you lose something...
wtf Python is also effected. https://pypi.org/project/brotli/ not sure about shell
Side point from going to pypi:
> Security notice: Upgrade certifi, pip, and uv in response to CA certificate incident
Blimey PIP is affected? That's bad. I feel like that should have been bigger news?
Because pip uses it's own certificate bundle, so even if you fix the system itself pip still needs its own upgrade to handle the eMudhra episode.
13 replies →
Pretty sure that's the eMudhra "private key is 4" issue.
I had to check all of our Python deployments and installation BOMs and was quite relieved - turns out that none actually installed brotli libraries. HTTP libraries like httpx, requests and frameworks consider them optional and autodetect their presence.
Pretty much everything that talks http has this Brotli library linked in. A quick file search on a Windows dev box showed:
- git
- Sublime text
- VS studio
- CUDA
- .NET
- inkscape
- AzureTools
This is yet another example of the incredible negative impact of Google’s pattern of crapping out open-source libraries without actually maintaining them, so that people just copy and paste them into their projects.
So, uh, isn’t the blast radius huge here? Like ticking time bomb for unpatched servers huge once someone figures out how to craft their br payload just right?
Browsers were patched back in March, but if you can get anything else that is unpatched to decode br, and most HTTP clients do by default, and you’ve figured out the right payload (yes not easy, but still), isn’t this, well, really bad? Like Heartbleed big?
git for windows is vulnerable even in its latest release (2.56.0.windows.3), careful pulling repos over https from random ass servers (prolly uncommon but hey). they already merged the fix on the repo, it's just in a snapshot build only; should prolly arrive on Monday (2.56.0.windows.4).
also affects codex (gui), which ships its own git, could be more of a problem there, when the LLMs get quirky at night. still unlikely to be a problem though.
speaking of, update codex (and wipe its cache at ~/.cache/codex-runtimes), ships its own node. update python.
stuff like wireshark and imhex remain vulnerable, even on their latest repo commits, which may or may not be spicy.
also Microsoft 365 Copilot still has its own unpatched brotlidec.dll from Oct 7, if anyone uses that. no fix available for that one afaik, not sure about how it can be made to access the vulnerable decoder.
why is this downvoted? are any of those not accurate?
Because a local software vuln is much less scary, less exploitable, and more common than an exploit like PHP2Shell, which requires basically no effort to exploit a large chunk of publicly exposed webservers. Basically, local vulns have been a thing forever and GP is off topic.
1 reply →
[dupe] https://news.ycombinator.com/item?id=50216791
"In 2016, the Brotli algorithm shipped in Chrome, delivering overall better compression ratios for eligible resources."
"By the end of 2017, all modern browsers supported Brotli, and server support for it started to become more widespread."
For www users, all that data collection, surveillance and ad services traffic to enrich so-called "tech" companies acting as intermediaries, can make the www exceedingly slow
The way to "make the web faster" (or less inefficient) is to get rid of that needless traffic, and the ads it supports
SPDY,^1 HTTP/2 Server Push,^2 HTTP/3 QPACK,^3 brotli, .... make www users ("ad targets" to Google) uninformed, nonconsenting subjects in Google's failed experiments
The www already works just fine for its intended purpose (_not_ data collection, surveillance and ad services)
1. "As of 2021, no major browsers supported SPDY" https://en.wikipedia.org/wiki/SPDY
2. https://en.wikipedia.org/wiki/HTTP/2_Server_Push
3. https://foxio.io/blog/header-accordions-qpack-amplification-...
I agree with you, but the immediate problem here seems to be that all major browsers support Brotli, and i think they all use the Google library, so they are all vulnerable.
Most of the discussion here is about vulnerabilities in servers, but it looks like its mostly a client problem.
Is there a way to turn brotli off?
Going back to your point, if we kept things simple we would be a lot more secure.
"OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses."
Every user is different
For me I'm a text-only user not interested in graphics
I do not use a so-called "modern" browser to make HTTP requests
I don't request brotli-compressed content/resources^1
Normally I don't send an Accept-Encoding header
Almost always servers to which I connect^2 will return uncompressed text, which is what I want. No Accept-Encoding header needed
Occasionally servers will send gzip-compressed text by default and will ignore "Accept-Encoding: identity"
However the popular so-called "modern" browsers will send an Accept-Encoding header whose value includes brotli (br) by default
Unsuspecting www users are consequently opted in to Google's brotli experiment. Me, I opt out
1. I use a text-only browser (1.3MB static binary) to read HTML. I compile it without brotli support
2. Other users may connect to different servers. Preferences vary from user to user
How may web servers only serve brotli?
How many clients only accept brotli?
Well it's negotiated, right?
So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
As an attacker I setup a new server that serves only brotli and then submit that URL to the SaaS.
Just send a POST with Content-Encoding:br to any URL and hope it gets decided before the URL route is checked.
> So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
That's a clever example, but why would you do that? The avatar should be a static resource. As such, I'd only provide an upload file dialog.
5 replies →
I really don't understand how so many different things are affected by the same brotli bug/exploit.
I even read the patch for the C code (patch which, btw, seems a bit hacky to me with isSafe? methods added and whatnots but YMMV: now I understand things had to be patched in a hurry but this patch really looks like "lipstick on a buffer overflowing C pig" to me).
What's the link between Python / Node / C++ / libbrotli / Envoy / Bun: are those some all using the same C brotli encoder/decoder?
Can someone who knows more explain why all those are vulnerable?
> As for unaffected software, Apache’s standard mod_brotli does not decode Brotli
Because this one only encodes and doesn't decode and the bug is in the decoder? (for I take it mod_brotli, with such a name, still does something brotli related and isn't, say, a TOTP token generator nor a SAT solver?).
I mean overall, sheesh: could we get better explanation / better writeups when such big fuckups happen?
Yes. All these language runtimes compile against common libraries. Compression libs are one of the most common common libraries that platforms like node, ruby, dotnet, python, and etc need to compile.
Google provides the Brotli implementation. Package maintainers slurp that up and create ie libbrotli-dev. When you compile node it uses that for brotli support.
Brotli was a library released by the Google team that developed it. There weren't lots of independent implementations; they were all from the same source code.
Or you can roll your own and not rely on the literal disaster that Google developed. Brotli is trivial to implement.
[flagged]
[flagged]
[flagged]
As I've mentioned numerous times at this point, relying on third party code is a massive liability (supply chain attacks/sloppy code). My hand rolled brotli implementation is not only faster than libbrotli but also immune to this vulnerability (yes, I checked). Roll your own code people.
Would you also apply this to cryptography or, well, really any security library? Because I hope the answer will be no...
Honestly it's time to get rid of C as a language used where security is a factor. Enough already. Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?
Security is a factor everywhere. And C is everywhere. There's not going to be a "rewrite everything in Rust" project until after there is some legit penalty for selling / offering software in C that could be more secure in another language.
I think Mozilla got it right when they abandoned the effort to rewrite the entire browser in Rust and instead focused on analysis of which modules needed priority rewrites. If a module has historically had zero memory-related bugs, then there are other higher priority things to spend time on.
That said, Google Project Zero should have had Brotli on their radar. Hopefully they still have people and resources.
I can understand why people used a C library for these apps, as when HTTP2 was specified, the C lib was the only game in down.
However, why not switch to the Rust lib when it was available? I suppose people at Dropbox are now pretty happy they did in 2016: https://dropbox.tech/infrastructure/lossless-compression-wit...
It's slower, though. Too high a price to pay for safety it seems.
Because these applications were created long before Rust existed.
There is a cost to conversion.
Rust-Brotli (by Dropbox) is actually a drop-in replacement for the Brotli C lib: https://github.com/dropbox/rust-brotli#:~:text=rust-brotli%2...
Dropbox switched to it a decade ago, so it's probably quite product-ready.
Brotil was actually created post rust, but before rust took off.
Check Librsvg, or php-rust. Or tons of gtk4-rs software doing it just fine.
It's not even an application it's a compression library
Why are we still so reliant on HTTP? HTTP came out in 1990 (36 years ago) and the most common version of HTTP still in use, 1.1 (RFC2616), came out in 1999 (27 years ago)?
Yes, I know HTTP 2 and 3 and SSE are attempts to make it faster and more parallel, but its still slow. Its slow because its unidirectional with a full round trip and by default its a new socket per each message. Yes, I know the real reason HTTP became and remains popular is because its sessionless... in theory. Still, there are better options available. You can do so much more with a full duplex channel.
We don't need new versions of http or SMTP because they're already simple and great and they're dumb protocols so there's not much you could ever add
If you want something else you can take your pick based on need from dozens of other options
HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.
SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.
For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.
2 replies →
"by default its a new socket for each message" is misinformation - keepalive is the default since HTTP 1.1 (1999).
Keep alive is not default behavior, so my prior comment was still more correct.
3 replies →
Agreed. The issue with all these archaic standards is that they were rolled decades ago back when certain practices were either outright not being employed OR that hardware wasn't fast enough. Ironically, HTTP itself is a literal nightmare to parse (performance wise) on top of having like... ten? distinct vulnerability classes. The world desperately needs new standards.
Just open a TCP socket and send JSON messages. Or if you want a bit more efficiency, fixed-format binary messages, but remember to include a version number.
4 replies →