Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
Self hosting is getting really exhausting lately… Maybe I will just gate everything behind a VPN and stop sharing my services with relatives :/
Yeah, I’m starting to think that a tunnel at the router level with family is a preferred approach. I dread the setup time, but it sure lowers the attack surface.
If you do the heavy lifting with external libraries in python, you are already running C code.
VPN enrollment is scanning a qr code nowadays. Or site2site, with a "plug this box into your network’ really shouldn’t be an obstacle in the year of the lord 2026
Putting everything behind a VPN is useless if i give people who routinely click phishing links (then ask me for help when/if they realize their mistake, that’s how I know) access to said VPN
Not if your threat model is “bots that scan the internet for vulnerable installations of X”.
A lot of these bot requests come from what seems to be compromised hosts turned into scanners and residential proxies.
True, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.
Nah just vibe code the stuff you host in Rust. These are all memory safety bugs.
My exception is Home Assistant which is unfortunately Python 🤢 but it’s not exposed to the internet.
99 times out of 100 a well used open source program written in any language is going to be more secure than something vibe coded in rust. Sure you wont get memory bugs (probably, if you’re just vibing it how do you know its not using unsafe rust?), but it is vastly more likely to just contain regular logic bugs.
I find it funny you’re hating on python right after praising vibe coded slop :D
Or maybe that was just sarcasm
I’m not praising vibe coded slop. Vibe coding with the latest models doesn’t produce slop anymore. And I’m not really praising that - just saying that it’s true.
I do some vibe coding using recent affordable models, it’s still slop. I guess the better, more expensive models are less sloppy, but 1. I don’t have unlimited funds and 2. I kind of hate that everyone is now asking their favorite models to re-invent the wheel. The token money that collectively goes into these projects would be spent so much better on financing established open source projects and their maintainers.
Anyway, even with “good” models and Rust, you’ll still get logic bugs which are usually far easier to actually exploit than memory corruption (for which going beyond crash/DoS to RCE often requires adapting to the specific build of the target, and generally a lot more time and effort)
Yes indeed, the cheap models still produce slop. Slightly annoying because I’d love to use them for personal projects, but as you say I can’t really justify the cost.
For work though it’s a no brainer, given my salary and the productivity boost. At my previous company I sometimes spent an entire day debugging a complex test failure that Claude can figure out in 5 minutes. No exaggeration.
Being able to find the cause of a bug and being able to build a decent codebase from scratch are definetly not the same
Agreed. I use it for coding too. Even using it as a kind of interactive editor is a huge productivity boost. E.g. I was working on some assertions that were all like
assert (... |-> a && b && c)(|->is implication) and I was like "Claude, split the consequent conjunctions into separate assertions " and it did it in about 5 seconds, vs 10 minutes of tedious hand editing.
Awww, not brotli. Bummer.
Well nginx brotli is probably most important
