Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
Self hosting is getting really exhausting lately… Maybe I will just gate everything behind a VPN and stop sharing my services with relatives :/
Yeah, I’m starting to think that a tunnel at the router level with family is a preferred approach. I dread the setup time, but it sure lowers the attack surface.
If you do the heavy lifting with external libraries in python, you are already running C code.
everything is exhausting… being 400th in queue in your hosting provider to see if they can patch vulns gets pretty goddamned old too
Nah just vibe code the stuff you host in Rust. These are all memory safety bugs.
My exception is Home Assistant which is unfortunately Python 🤢 but it’s not exposed to the internet.
99 times out of 100 a well used open source program written in any language is going to be more secure than something vibe coded in rust. Sure you wont get memory bugs (probably, if you’re just vibing it how do you know its not using unsafe rust?), but it is vastly more likely to just contain regular logic bugs.
I find it funny you’re hating on python right after praising vibe coded slop :D
Or maybe that was just sarcasm
I’m not praising vibe coded slop. Vibe coding with the latest models doesn’t produce slop anymore. And I’m not really praising that - just saying that it’s true.
I do some vibe coding using recent affordable models, it’s still slop. I guess the better, more expensive models are less sloppy, but 1. I don’t have unlimited funds and 2. I kind of hate that everyone is now asking their favorite models to re-invent the wheel. The token money that collectively goes into these projects would be spent so much better on financing established open source projects and their maintainers.
Anyway, even with “good” models and Rust, you’ll still get logic bugs which are usually far easier to actually exploit than memory corruption (for which going beyond crash/DoS to RCE often requires adapting to the specific build of the target, and generally a lot more time and effort)
Yes indeed, the cheap models still produce slop. Slightly annoying because I’d love to use them for personal projects, but as you say I can’t really justify the cost.
For work though it’s a no brainer, given my salary and the productivity boost. At my previous company I sometimes spent an entire day debugging a complex test failure that Claude can figure out in 5 minutes. No exaggeration.
Being able to find the cause of a bug and being able to build a decent codebase from scratch are definetly not the same
Agreed. I use it for coding too. Even using it as a kind of interactive editor is a huge productivity boost. E.g. I was working on some assertions that were all like
assert (... |-> a && b && c)(|->is implication) and I was like "Claude, split the consequent conjunctions into separate assertions " and it did it in about 5 seconds, vs 10 minutes of tedious hand editing.
Awww, not brotli. Bummer.
Well nginx brotli is probably most important
