Hacker News Reader

Comment by netsharc | Hacker News Reader

Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.

It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?

You might as well call it Exploit Pro Max...

View on HN

I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.

AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.

No human reviews anything anymore so of course they aren't going to catch it.

Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"

LLM-based AI is a synthesis of human observed behavior

But does it bring synergy with our current paradigm?

Descriptive type names are a good thing. Id argue that one isnt that bad, but llms do take it to another level sometimes.

That means that it supports other services with OpenAI-compatible embeddings APIs (not just OpenAI's own API). Seems reasonable!

Fortunately I didn't ask it for excuses and so it didn't give them like a pedantic junior on the spectrum.

Which they will happily do if you ask them "why" they did something. 100% they will give their best "well actually" impression.

`OpenAICompatible` is also a widely used phrasal description of a part/version of the OpenAI API that is supported by quite a lot of endpoints.

- https://lmstudio.ai/docs/developer/openai-compat

I've seen that used as a description for 2years or so.

Should have definitely been Brotli2Shell, but Google ingeniously managed to dodge that bullet by having NodeJS come out with a fix before they did (others might call that accidental exposure), and then barely communicating about that with the broader community once they finally did. Here's a timeline of events[0] and here's me more broadly complaining about Google's stance[1]

[0] https://www.bugsink.com/blog/http2shell-timeline/

[1] https://news.ycombinator.com/item?id=50230362

Bro2Shell sounds better though

It will never not amuse me that Mozilla changed the Brotli extension to avoid this very connotation

https://bugzilla.mozilla.org/show_bug.cgi?id=366559#c147

A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?

(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)

A better name is Fred, because

Feels like the goal was sensationalism.

Something that OpenAI would coin. Just like Anthropic did with Mythos.

Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.

Or EUVD-2026-108169.

I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.

Yeah, because the six number chunk is near the limit of recall. Don't remember CVE-2026 since the year and CVE can be reconstructed from time memory. You know it came up this year. Remember that vuln 111-497 (as two chunks) came out this year, and remembering two short chunks is easier.

I don’t know why you’d want to remember the number, but this one seems easy if you know some memory techniques.

> Remember that vuln 111-497 (as two chunks)

Good first step. Remember it’s two sets of three numbers. The first set is all ones, meaning the first three numbers are 1, then the fourth number is 4, then you add five for the next one (9), then you have to remember to subtract two (7)¹.

May sound silly, but I bet some of you have already memorised it from that alone. Being a slightly convoluted by still logical set-by-step helps with recollection.

¹ Lot of different ways to go about that, like remembering that the first set was three of one so “two was left out”.

Fun fact: not even Google can remember that number on the first try, apparently:

https://github.com/google/brotli/issues/1597

I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.

Specifically Brotli2Shell

google2shell would have been nice :D

Alt-tabbing from browser to terminal and back has always felt exhausting. Nice.

With ad served malware, this wouldn't be the first time though :)

It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.

Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.

> while Brotli2Shell might not wake up people that know what it is.

And, most of all, is damaging to Google, which are the master of software engineering. /s

Actually it does, if the server is willing to decompress POST bodies.

Brotli bodies, so Brotli2Shell

And only those using Google's Brotli implementation.

What are the other implementations?

The author clearly used super intelligence.

You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.

I mean...who cares? It's actually kind of strange that your comment got others talking about AI naming things.

SQL Slammer didn't actually slam anything, and applied to a single vendor among many SQL providers. Heartbleed didn't make anyone's heart bleed...I mean, at least directly. Shellshock only impacted a single shell environment, again among many. Log4Shell impacted a single logging implementation, among many. Spectre and Meltdown...I mean, who would think that related to CPU cache side channels?

These are just dumb names for people to share in referring to something. Seems silly and like a waste of time to spend effort getting upset about them.

All these names are silly. It's just marketing.

There are levels of silliness, and this has achieved a new one.

Reply on news.ycombinator.com