Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more

    • FizzyOrange@programming.dev
      link
      fedilink
      arrow-up
      1
      arrow-down
      6
      ·
      7 days ago

      I’m not praising vibe coded slop. Vibe coding with the latest models doesn’t produce slop anymore. And I’m not really praising that - just saying that it’s true.

      • pcouy@lemmy.pierre-couy.fr
        link
        fedilink
        arrow-up
        3
        ·
        7 days ago

        I do some vibe coding using recent affordable models, it’s still slop. I guess the better, more expensive models are less sloppy, but 1. I don’t have unlimited funds and 2. I kind of hate that everyone is now asking their favorite models to re-invent the wheel. The token money that collectively goes into these projects would be spent so much better on financing established open source projects and their maintainers.

        Anyway, even with “good” models and Rust, you’ll still get logic bugs which are usually far easier to actually exploit than memory corruption (for which going beyond crash/DoS to RCE often requires adapting to the specific build of the target, and generally a lot more time and effort)

        • FizzyOrange@programming.dev
          link
          fedilink
          arrow-up
          1
          arrow-down
          1
          ·
          7 days ago

          Yes indeed, the cheap models still produce slop. Slightly annoying because I’d love to use them for personal projects, but as you say I can’t really justify the cost.

          For work though it’s a no brainer, given my salary and the productivity boost. At my previous company I sometimes spent an entire day debugging a complex test failure that Claude can figure out in 5 minutes. No exaggeration.

          • pcouy@lemmy.pierre-couy.fr
            link
            fedilink
            arrow-up
            1
            ·
            7 days ago

            Being able to find the cause of a bug and being able to build a decent codebase from scratch are definetly not the same

            • FizzyOrange@programming.dev
              link
              fedilink
              arrow-up
              1
              arrow-down
              1
              ·
              7 days ago

              Agreed. I use it for coding too. Even using it as a kind of interactive editor is a huge productivity boost. E.g. I was working on some assertions that were all like assert (... |-> a && b && c) (|-> is implication) and I was like "Claude, split the consequent conjunctions into separate assertions " and it did it in about 5 seconds, vs 10 minutes of tedious hand editing.