Comment by netsharc
1 day ago
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?
(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)
I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.
AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.
No human reviews anything anymore so of course they aren't going to catch it.
Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"
That means that it supports other services with OpenAI-compatible embeddings APIs (not just OpenAI's own API). Seems reasonable!
`OpenAICompatible` is also a widely used phrasal description of a part/version of the OpenAI API that is supported by quite a lot of endpoints.
- https://lmstudio.ai/docs/developer/openai-compat
I've seen that used as a description for 2years or so.
Fortunately I didn't ask it for excuses and so it didn't give them like a pedantic junior on the spectrum.
Which they will happily do if you ask them "why" they did something. 100% they will give their best "well actually" impression.
LLM-based AI is a synthesis of human observed behavior
But does it bring synergy with our current paradigm?
Descriptive type names are a good thing. Id argue that one isnt that bad, but llms do take it to another level sometimes.
Feels like the goal was sensationalism.
Something that OpenAI would coin. Just like Anthropic did with Mythos.
Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.
I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.
Yeah, because the six number chunk is near the limit of recall. Don't remember CVE-2026 since the year and CVE can be reconstructed from time memory. You know it came up this year. Remember that vuln 111-497 (as two chunks) came out this year, and remembering two short chunks is easier.
Or EUVD-2026-108169.
Actually it does, if the server is willing to decompress POST bodies.
Brotli bodies, so Brotli2Shell
And only those using Google's Brotli implementation.
1 reply →
I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
Specifically Brotli2Shell
google2shell would have been nice :D
2 replies →
The author clearly used super intelligence.
You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.
It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.
Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.
All these names are silly. It's just marketing.
There are levels of silliness, and this has achieved a new one.