Hacker News new | past | comments | ask | show | jobs | submit
netsharc | on: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.

It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?

You might as well call it Exploit Pro Max...

vanschelven | parent | next
Should have definitely been Brotli2Shell, but Google ingeniously managed to dodge that bullet by having NodeJS come out with a fix before they did (others might call that accidental exposure), and then barely communicating about that with the broader community once they finally did. Here's a timeline of events[0] and here's me more broadly complaining about Google's stance[1]

[0] https://www.bugsink.com/blog/http2shell-timeline/

[1] https://news.ycombinator.com/item?id=50230362

francisduvivier | root | parent
Bro2Shell sounds better though
loading story #50232766
Rapzid | parent | next
I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.

AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.

No human reviews anything anymore so of course they aren't going to catch it.

Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"

rafram | root | parent | next
That means that it supports other services with OpenAI-compatible embeddings APIs (not just OpenAI's own API). Seems reasonable!
ketzu | root | parent | next
`OpenAICompatible` is also a widely used phrasal description of a part/version of the OpenAI API that is supported by quite a lot of endpoints.

- https://lmstudio.ai/docs/developer/openai-compat

I've seen that used as a description for 2years or so.

Rapzid | root | parent
Fortunately I didn't ask it for excuses and so it didn't give them like a pedantic junior on the spectrum.

Which they will happily do if you ask them "why" they did something. 100% they will give their best "well actually" impression.

rmaxdev | root | parent | next
LLM-based AI is a synthesis of human observed behavior
loading story #50226747
lifeisloving | root | parent
Descriptive type names are a good thing. Id argue that one isnt that bad, but llms do take it to another level sometimes.
super256 | parent | next
A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?

(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)

cowlevel | root | parent
A better name is Fred, because
CharlieDigital | parent | next
Feels like the goal was sensationalism.
cromka | root | parent
Something that OpenAI would coin. Just like Anthropic did with Mythos.
rererereferred | parent | next
Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.
vanschelven | root | parent | next
Fun fact: not even Google can remember that number on the first try, apparently:

https://github.com/google/brotli/issues/1597

kevincox | root | parent | next
I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.
loading story #50226748
N19PEDL2 | root | parent
Or EUVD-2026-108169.
cowlevel | parent | next
Actually it does, if the server is willing to decompress POST bodies.
croes | root | parent
Brotli bodies, so Brotli2Shell
loading story #50229064
techpression | parent | next
I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
CharlieDigital | root | parent
Specifically Brotli2Shell
loading story #50220777
reddozen | parent | next
The author clearly used super intelligence.
Stitch4223 | root | parent
You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.
TZubiri | parent | next
It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.

Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.

hulitu | root | parent
> while Brotli2Shell might not wake up people that know what it is.

And, most of all, is damaging to Google, which are the master of software engineering. /s

groundzeros2015 | parent | next
All these names are silly. It's just marketing.
sigmarule | root | parent
There are levels of silliness, and this has achieved a new one.
llm_nerd | parent
I mean...who cares? It's actually kind of strange that your comment got others talking about AI naming things.

SQL Slammer didn't actually slam anything, and applied to a single vendor among many SQL providers. Heartbleed didn't make anyone's heart bleed...I mean, at least directly. Shellshock only impacted a single shell environment, again among many. Log4Shell impacted a single logging implementation, among many. Spectre and Meltdown...I mean, who would think that related to CPU cache side channels?

These are just dumb names for people to share in referring to something. Seems silly and like a waste of time to spend effort getting upset about them.