Hacker News new | past | comments | ask | show | jobs | submit
illusive4080 | on: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Why do critical vulnerabilities get a cutesy name and website nowadays? Who’s paying for these sites?
cyphar | parent | next
This has been the case for more than a decade, Heartbleed was probably the one which really created the trend.
| root | parent
{"deleted":true,"id":50229298,"parent":50229005,"time":1792915257,"type":"comment"}
Flere-Imsaho | parent | next
The same reason we name storms and hurricanes... It's easier to raise awareness, and refer to these things after the fact. More memorable then CVE-whatever.

I find it helpful at least...

sbarre | parent | next
Small static websites are effectively free (Cloudflare, GCP free tier, etc)..
reassess_blind | root | parent
Domains aren’t
mynameisvlad | root | parent | next
Sure, but domains aren't going to be more than $10 or $20 for the year they're relevant.
ygjb | root | parent
\o/

1. See a vuln domain reported, clone the site. 2. Wait for it to expire and snag it. 3. Republish the site with malware 4. Watch people dither about domain names and stuff instead of taking time to fix things.

DaSHacka | root | parent | next
Most domains are only like ~$10/year. I already have a handful registered for potential project ideas because they're borderline free, for major vulnerabilities I would do the same.
ygjb | root | parent
Sure they are. The domain you want isn't.

GitHub.io domains, workers.dev domains, etc are all free domains.

Clever use and abuse of some startups can get you a free domain with a signup package that you can subsequently transfer out, but those are harder to find these days.

Seriously, the bad guys figure this out all the time.

cubefox | parent | next
I'm certainly not complaining about some selfless guy making a helpful website without expecting anything in return!
nicce | root | parent
They excpect fame and may make things look worse than they are
mynameisvlad | root | parent | next
How, exactly, are they making "things look worse than they are"? By.... showing what the issue is?
nicce | root | parent
Not particularly referencing to this link, but usually severity is made more severe than it actually is. One kind of sensationalism is usually used.
cubefox | root | parent
No, they aren't. The website doesn't list an author, so fame is out of the question, and they say exactly how severe the bug is rated ("Rated 9.2 Critical (CVSS 4.0) by GitHub, High by Node.js.") right at the top.
nicce | root | parent
There is named entity in the end, and "we" statement. But yeah, I was speaking in general, not so specifically about this page. It is better than most who do this.
TZubiri | parent | next
Are you asking why do we name things? In a programming forum?
solyin | root | parent | next
Listen. There are TWO problems, okay‽
TZubiri | root | parent
Wasn't it three?
yallpendantools | root | parent
Last I heard it was 10 or 11 but definitely not 0x3.
| root | parent
{"deleted":true,"id":50223923,"parent":50222949,"time":1792867461,"type":"comment"}
o_m | parent | next
It is annoying (and ironic) because larger companies, that will benefit from this information the most, blocks newly registered domains.
illusive4080 | root | parent
Yep, this website was blocked at my work all day yesterday despite me submitting it for review.
DaSHacka | root | parent
Protip, use the Wayback Machine as a proxy to get around firewalls if you only need to view content from a static site.

My work blocks every commercial AI service, but I just want to read the static blogs and benchmarks from the large labs to keep up with recent news and developments in the space and the Wayback Machine trick works perfectly for that.

tclancy | parent
You remember CVEs by heart? Do you even bother using DNS?