A brutal week for security, and everyone feels it
Several security stories hit at once. A post claims the iPhone was hacked (one commenter wasn't sure it was real, but said "this week is unbelievable"). Node2Shell grew into HTTP2Shell, with a blast radius across many HTTP libraries and apps. Commenters found Python's brotli package is affected too. A CVE Tracker went up, and a Show HN demoed autonomous root on a Tcl Android TV via CVE-2022-22706.
The mood in the threads is fatigue more than panic. "Just put it onto the pile." "Who turned on hard mode this week?" The joke about the CVE tracker is that it explains why everyone is "a bit busy." One commenter asked whether SRE jobs are easier to get now because demand ought to be up.
The pattern: patch queues keep growing faster than teams can clear them. Bugs now hide in shared dependencies like HTTP parsers and compression libraries that nobody on your team chose on purpose.
So what?
Know your transitive dependencies, especially HTTP and compression libraries, and have a way to patch them in hours, not weeks. If you sell to enterprises, a fast and visible patch process is now a sales feature.
Read these
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Today, we hacked what we'd set out to hack: the iPhone
CVE Tracker
Show HN: Autonomous root for Tcl Android TV via CVE-2022-22706
Apple Security Research Device