Infrastructure keeps breaking in boring, expensive ways

Broccoli2Shell, an RCE in Brotli decoders, hits Node.js, Python and more. One commenter noted that the Brotli package on PyPI is affected too. Another asked 'Who turned on hard mode this week?' and said they would just put it on the pile of patches. Dreamhost had an active incident forcing password resets, and commenters asked if the host is falling apart. Elsewhere, an AWS billing bug showed hobby accounts owing hundreds of millions, even billions, of dollars in estimated charges. People joked about heart attacks, though one said it finally scared them into locking down old accounts. A Spain thread described Docker pulls failing because La Liga football blocking in Spain also catches Cloudflare R2.

The pattern here: shared dependencies and shared chokepoints (a compression library, a CDN, a cloud billing system) mean one failure reaches thousands of companies that did nothing wrong. Several comments reached for the same fix, which is to avoid a single point of dependence. Others said that technology companies should take an active role in local politics.

The counterpoint is that most of these were visible and short-lived. The billing numbers were obviously wrong, and the Brotli flaw is at least known before widespread exploitation.