logoalt Hacker News

bawolff • today at 12:28 PM • 1 reply • view on HN

To me, the surprising part is how many of these implement brotli compression of request (not just response) bodies, given how obscure a feature that is.

In any case all this sensationalism is starting to get annoying. Patch your stuff and move on.

Edit: actually, between all the sensationalism, its hard to tell from the article how many of these actually support brotli compressed request bodies in common configs vs some other use of brotli (which is bad but nowhere near as critical)


Replies

ArcHound • today at 12:34 PM

I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.

So as a hotfix I block this on my reverse proxy.

➕ show 1 reply