Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!
I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.
Source https://github.com/google/brotli for who wants to do a real security audit.
Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!
I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.
Author here, happy to discuss.
I also constructed (with agentic help) this absolute mess of a timeline (linked in the article, but I think interesting on its own):
https://www.bugsink.com/blog/http2shell-timeline/