Hacker News new | past | comments | ask | show | jobs | submit
1vuio0pswjnm7 | on: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
"In 2016, the Brotli algorithm shipped in Chrome, delivering overall better compression ratios for eligible resources."

"By the end of 2017, all modern browsers supported Brotli, and server support for it started to become more widespread."

For www users, all that data collection, surveillance and ad services traffic to enrich so-called "tech" companies acting as intermediaries, can make the www exceedingly slow

The way to "make the web faster" (or less inefficient) is to get rid of that needless traffic, and the ads it supports

SPDY,^1 HTTP/2 Server Push,^2 HTTP/3 QPACK,^3 brotli, .... make www users ("ad targets" to Google) uninformed, nonconsenting subjects in Google's failed experiments

The www already works just fine for its intended purpose (_not_ data collection, surveillance and ad services)

1. "As of 2021, no major browsers supported SPDY" https://en.wikipedia.org/wiki/SPDY

2. https://en.wikipedia.org/wiki/HTTP/2_Server_Push

3. https://foxio.io/blog/header-accordions-qpack-amplification-...

graemep | parent | next
I agree with you, but the immediate problem here seems to be that all major browsers support Brotli, and i think they all use the Google library, so they are all vulnerable.

Most of the discussion here is about vulnerabilities in servers, but it looks like its mostly a client problem.

Is there a way to turn brotli off?

Going back to your point, if we kept things simple we would be a lot more secure.

1vuio0pswjnm7 | parent
"OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses."

Every user is different

For me I'm a text-only user not interested in graphics

I do not use a so-called "modern" browser to make HTTP requests

I don't request brotli-compressed content/resources^1

Normally I don't send an Accept-Encoding header

Almost always servers to which I connect^2 will return uncompressed text, which is what I want. No Accept-Encoding header needed

Occasionally servers will send gzip-compressed text by default and will ignore "Accept-Encoding: identity"

However the popular so-called "modern" browsers will send an Accept-Encoding header whose value includes brotli (br) by default

Unsuspecting www users are consequently opted in to Google's brotli experiment. Me, I opt out

1. I use a text-only browser (1.3MB static binary) to read HTML. I compile it without brotli support

2. Other users may connect to different servers. Preferences vary from user to user