Don't forget to upgrade your brotli package. And make sure it's not vendored by any package you use (because of the broken distro model), as that will have to be fixed separately.If you only rely on the brotli rust implementation from dropbox, then NO WORRIES, you never had the problem.Stay safe everyone.
Cniles can't write safe code.
>>110157459>>110157469samefag threadall fields can grow sage
Another shit lossless compressor some projects want to use because reasons. If you use feh, mupdf or anything qt6 make sure to upgrade it.
>>110157531you know what's sad about your ban? you weren't even right lol
>>110157584huh? what is this brand of schizo? can a third anon drop the deets on this raging autist I need to know
>>110157459>If you only rely on the brotli rust implementation from dropbox, then NO WORRIES, you never had the problemUh oh sepples meltdown is icumenNannies on high alert
Yet another scam.If you believe in this super serious broccoli vulnerability, you probably also took the CoViD vax, bought NFTs and shut down your server because of the super serious php vulnerability.
>>110157459Sepples and Cniles do be like>Well you just jeed to write good codekek. Everyone will spend 2027 rewriting their shit in Rust
>>110157459Not falling for your liesProof of concept or GTFO
>>110157609>>110157469>>110157459k
>>110157590I was one of the two anons you assumed were the same, retard.
>>110157635yery cute, anon.If it wouldn't be for you fearmongering monkeys spamming on /g/, i wouldn't even notice that i am supposed to get hacked every other day.First i get hacked because of php, then i get hacked because of the daily Rust sudo-rs vulnerability and now i get hacked because of broccoli.It is just weird that it never manifests into existence. It never results in anything.
>>110157635>im not samefagging because i said souh huh, don't care.im more interested in what the fuck you've been having a melty about and what did anon say that was so based you had to sic a jeet mod on him.
>>110157669You don't wait for someone to hack you, you patch when a possible vulnerability is discovered, possibly immediately if the urgency is high. That's what CVEs are for. The CVE in this case is rated 9.2/10.
>>110157601>>110157616>WA WA IT'S NOT REAL WA WA
>>110157690I don't patch and don't get hacked.80% of servers out there are still vulnerable to the php "vulnerability" you monkeys fearmongered about and nothing is happening to them.What now?
>>110157756>I don't patch and don't get hacked.You never update any packages? Never update your OS? Are you using Windows XP?>80% of servers out there are still vulnerable to the php "vulnerability" you monkeys fearmongered about and nothing is happening to them.Oh you personally talked to each one of them? Are you some god among men that can detect botnet and rootkits even when the admins can't?
>>110157756>80% of servers out there are still vulnerable to the php "vulnerability"Source?
>>110157690>THE SCORE IS HIGH, BE SCAREDYou are supposed to be knowledgeable enough to actually read the documentation and judge whether or not it applies to you.If you rely on someone on the TV tell you about how super serious something is, i guess you also took the CoViD vax.For most of the vibe slopped nu-CVEs, we simply do not even get any documentation. We don't see a proof of concept. So i will ignore them.If you want me to take you serious, tell me how this vulnerability can exploited.
>>You NEVER do itWhere did i say never?Are you fearmongers really all low-IQ monkeys? You don't even understand basic words that are written.>>110157778pic related
>>110157675>you're samefagging because i said soyou must be one of the smartest /g/eets around lol.this actually reflects the duality between /g/eets larping as "C devs", and rustaceans.i know if i samefagged or not, you don't.rustaceans know if their code is type/thread/memory safe or not (to a degree), the caricature of the /g/eet "C dev" doesn't know, and couldn't know (in the imaginary world where "it" actually codes).and yet, the latter party cries and whines about the former accusing them of not knowing what they can know, when the latter can't even know.-------i'm only replying to you to make you enjoy your (you)s before a fellow /g/eet janny bans you btw (public sages are fun. i wouldn't ban them. but i'm not a janny.)
>>110157781>>110157790Fucking retard, be sorry when you get hacked.
>>110157793kanyone know what the fuck he's on about though
>>110157793An employee of Microsoft with an indian accent recently called me. He said that there was a super serious vulnerability, but that he can't tell me what it is about, because it is secret. He offered a .exe that fixes it.He said that there is a secret fix, but only selected corporations are allowed to know it, and that it already gets exploited in the wild.I was questioning it, but then i remembered that this is exactly how reputable corporations like AWS, Cloudflare and OpenAI handled the php vulnerability, which was absolutely real.So i immediately run his .exeI am protected now.
>>110157800>y-y-you will totally get hacked, i swear!Watch me not get hacked.Watch Microsoft Azure get hacked the tenth time this year.Watch Cloudflare crash by .unwrap() to the fifth time.Watch Google Accounts getting hacked thanks to Googles lacking security yet again.Meanwhile i am safe, because i am not a monkey following some idiotic fearmongering done by low-IQ people.
gzip would never
>>110157459Thanks, I have already downloaded and unpacked https://github.com/google/brotli/releases/download/v1.2.1/brotli-x64-windows-static.zip on my Windows when it appeared in https://github.com/google/brotli/releases.atom
>>110157807>he thinks php gave out an "exe"lol the /g/eet is actually literally tech illiterate
>>110157839
>>110157459I do not use Google garbage.Brotli got made and shilled by Google.When an American corporation promotes something, i know to stay away from it. Only someone who sucks corpo dick would ever be affected by this.
Brotli was controversial from the start because it came from "Brogrammer" culture and they had the abbreviation from "bro" to "br".
>>110157855>/g/eet>wintard>vlcsnap (not even "its" machine)>zero knowledge>can't into basic logicperfect
>>110157862>i do not useyou couldn't have made this comment without a browser that supports brotli, and without multiple services along the way also supporting brotli
>>110157905about:confignetwork.http.accept-encoding.secure remove brimage.avif.enabled falseWhy does none of the fearmongering monkeys suggest to simply turn off the vulnerable google garbage?
>>110157900you just can't stop taking Ls
>>110157937>/home
The moment corpos got exposed as liars and their fake CVEs questioned, the tone of the Rust shill shifted.Suddenly defending corporations became the highest priority. The Rust shilling vanished. Because >>110157669 listed the recent Rust vulnerabilities as well.He couldn't defend Rust anymore, without agreeing to the notions that big corpos are liars.So he had to decide:Continue shilling for Rust, or defending corpos? Both together doesn't work.He preferred corpos.Google, Amazon, OpenAI, Microsoft are his gods, who he worships. Questioning them is blasphemy against his gods.Similarly, the suggestion to simply disable corpo crap that got exposed as being vulnerable, is not an option he considers. This >>110157921 will never get a honest reply.
>>110157781Brotli is negotiated by the protocol. You have no way to control it if the software makes any kind of http call, in the case of nodejs. It's easy to exploit.
>>110158208Youve lost it. Youve fucking cracked. All this because of C++ bugs.
i use nginx with brotli on my serveram i raped?
>>110158255>It's easy to exploit
>>110158371no. you would be potential raper however ;)it's a decoder bug. if you're not decoding from untrusted sources, you're fine.
>>110158255nginx on ubuntu has brotli disabled by default.Brotli isn't even good! If you make the decision on what compression algorithms to support (it IS your decision), and you are knowledgeable, you will most likely decide to not support it.And even IF you decide to support that Google garbage, there is a 99.9999% chance that this vulnerability still doesn't affect you and isn't usable in the real world, just like the PHP vulnerability was.As said:You are supposed to be knowledgeable enough to actually read the documentation and judge whether or not it applies to you.You clearly aren't. You are a fearmongering low-IQ monkey.You do not know what you are talking about.
>>110157921>retard thinks a server can't ignore accept-encoding request headerslmao
>>110157855>>110157937>>110157960SAAR, PHP is only available as "php.exe", which I run on linux. What part is confusing you, saar?
80% of sysadmins ignored your fearmongering and kept running old outdated php.They did not shut down and did not update.You are in the tiny minority, living in a parallel universe where all of us get hacked every other hour.And now every single person visiting websites on the internet gets hacked as well.I am sure it is real in your mind.
>>110157769>Are you some god among men that can detect botnet and rootkits even when the admins can't?He is the botnet operator.
>>110158837Sam Altman is my god. When he says that a vulnerability is serious, it is, even when he delivers no evidence and there is nobody who could make it work in the real world.
>>110157459Building anything in C or C++ now should be illegal and send you to jail
>>110159024
>>110159031*ruff* *ruff*
>>110158416Nodejs will handle brotli for you if you use the fetch primordial. Popular http server frameworks will decode brotli bodies. Again, don't be retarded.
>>110159111>popular http server frameworksWhat is more popular than nginx?And who the fuck calls it a "http server framework"?
>>110159111The default http.createServer() in nodejs doesn't handle any decompression whatsoever.There isn't any need to decompress anything anyway, the form a client submits has no content-encoding.You cybersecurity fearmongers collect one L after another. You have no idea what you talk about.
brotli is written in C and thus unfit for the modern world.
>>110159266Based and correct take. People forgot how the webp library led to 0 click exploits.
>>110159274>>110159266
>>110159254>The default http.createServer() in nodejsNo one does this though. They use express or koa with a body parser that does.That's the point. Still doesn't address unidici either (the node impl of fetch)
>>110157756post url toughguy
>>110159288>No one does this thoughI do it.>They use expressexpressjs doesn't handle compression per default either
>>110159287how is that edgy doe? it's just facts.
>>110159287Dogs are disgusting inbread mutants that will dissappear in a couple of decades because they will come out sterile
>>110159288>with a body parserRequest bodies are not compressed.
>>110159297learn to read, dumb fuck.>>110159313are you literally retarded?
>>110157459usecase for outdated packages?
>>110159318In order to compress a request body, the client would first have to ask the server what encoding he accepts.You would need a preflight request and the latency of that request would be longer than sending those few bytes you would save.Press F12 when sending your next uninformed cope post and check what compression your post request has.It is plaintext multiform data.Not a single person in this world has a brotli decompression in his express body parser middlewares.This simply does not exist.
>>110157781too fat and haggish
>>110158955>the retard thinks php is closed source or smthlol
>>110159024regulations will come in 2-4 years. the prep work for them already started even before "AI" became good(ish).
>>110159800The patch released after the fearmongering and today we know for a fact that it was a scam.
>>110159883who's we? your anti-vax facebook boomer group?
>>110159900>who's we?Everybody who is competent enough to check out the proof-of-concept attempts.The closest anyone ever got to use this "vulnerability", was in a lab environment where php had to get DDoSed for a large time and not a single other request had to get in during that period or it would reset the whole procedure.If you aren't competent and you fully rely on the tweets of Sam Altman and other scammer... then i understand that you fell for the scam.People who are smart do not fall for scammers, because they can judge whether something is or isn't real. They do not have to take the word of someone from twitter.
>>110159978then you should have no problem answering >>110159293's request
>>110160001senioradvisor.com32.188.39.210php version 8.3.11Go to town with it!
>>110160001he.net65.19.144.217 running php 4.4.0 and perl 5.8.0It is affected by not less than 560 (!!!) CVEs.It is the website of the company that operates the largest internet transit network on the world.
>>110160093>>110160001Fuck it, i can even give you a list of current CVEs it is affected by, many "Critical".Getting your name into history by hacking the website of LARGEST ISP ON THE WORLD.Surely you should be easily able to do it, with all those super serious vulnerabilities.They can't all be scams, right? Right?
>>110160054>>110160093>>110160118>php.exe>kde>doesn't know what a backport ispost your own "unpatched" server url tough guy
>>110160293I am sure Hurricane Electric is entertaining their own php 4.4.0 fork and employs a dozen code monkeys to develop backports specifically for them.That is totally a sane and realistic assumption.
>>110160370why aren't you posting your own server url running unpatched "php.exe" on linux which doesn't need an update because the php CVE's were a scam?
>>110160520here it is >>110160093
>>110161057Prove it.I just made a request with a custom user-agent. What is it?
>>110159353you're literally retarded. a browser (and node) will say they accept-encoding: br or will decode it if advised. headers from clients like accept-* are advisory at best.
>>110159353alsohttps://expressjs.com/en/resources/middleware/body-parser/>All parsers support automatic inflation of gzip, br (brotli), deflate and zstd encodings. zstd is available in Node.js ^22.15.0 and >=23.8.0.kwab.
>>110161885the /g/eet went to sleep. you'll have to wait until 1:00-2:00 UTC until the next tard-maxxed comment.
>>110161870you dont even know the difference between request and response, you fucking idiot.I hate cybersecurity tards so much, its unreal.You are all disgusting scammers who cant do shit.
Lately all these threads are filled with seethe, why's that?>n-not upgrading CHUDIt's hilarious. Are you anons Israeli? Eglins? Chinks?
>>110162434There is a thread right now in the catalog about a >2000 USD challenge.If your vulnerabilities are real, you can get free 2 grand right now.
>>110162467You do understand how these things work right? They embargo the vuln, then issue a patch, then later on people figure out what it was.I've noticed you. You're good at getting noticed, ain't ya? Hmmmm? Gonna try to overdo it and get noticed a bit? That's your thing. Overdoing it. Nobody's buying what you're selling either, so that makes you angry and you overdo it even more, which makes more people notice.Very strange, non-White behavior.
>>110162550Seems to have worked very well. I didn't even know this was an issue. Just checked my system and it's already patched.
>>110162629>Seems to have worked very well.Nah people have been calling you out, lel. I don't think you're going to influence people not to update. Very strange and non-White behavior.
