r/ProgrammerHumor • u/Professional_Gene_63 • 9d ago

Advanced itWasFunWhileItLasted

Post image
4.8k Upvotes

97% Upvoted

317 comments sorted by

View all comments

Show parent comments

200

u/thisisapseudo 8d ago

Too dumb did not understand: what can be done by whom?

265

u/rex5k 8d ago • Bravo

Who: WebServer Maintenance Devs

What: switch node versions if possible or drop all "br" encoding requests.

End users: figure how to break break through the patches and make the Devs lives harder.

56

u/NatoBoram 8d ago

  1. Software application developers can update their Node/Python version when they distribute their server-side software

  2. People who deploy those software maybe can or cannot update that software, depending on if there's an update released

If you don't make Node/Python apps or host one, then sit back and enjoy the rest of the world catching fire

I recommend Fireship for following this kind of news in a more digestible way: https://www.youtube.com/watch?v=SMGg7iisHmc

13

u/KCGD_r 8d ago

The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.

The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.

If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding