HackiNews

• runningmike
  Source https://github.com/google/brotli for who wants to do a real security audit.

  Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!

  • vanschelven
    I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.

    I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small

    One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.

• vanschelven
  Author here, happy to discuss.

  I also constructed (with agentic help) this absolute mess of a timeline (linked in the article, but I think interesting on its own):

  https://www.bugsink.com/blog/http2shell-timeline/

  • galadran
    Something that has flown under the radar and is missing from your timeline: https://bugzilla.mozilla.org/show_bug.cgi?id=2029458

    • vanschelven
      Wow it's even more insane than I thought. That actually expands into 3 more relevant dates, all of which I've added to the timeline.
    • galadran
      Fx independently discovered the RCE which Google had silently patched and flagged it in April.
  • mplantsheer
    Thanks for the timeline!