Something that has flown under the radar and is missing from your timeline: https://bugzilla.mozilla.org/show_bug.cgi?id=2029458
Fx independently discovered the RCE which Google had silently patched and flagged it in April.
Wow it's even more insane than I thought. That actually expands into 3 more relevant dates, all of which I've added to the timeline.
Thanks for the timeline!
Source https://github.com/google/brotli for who wants to do a real security audit.
Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!
I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.
Author here, happy to discuss.
I also constructed (with agentic help) this absolute mess of a timeline (linked in the article, but I think interesting on its own):
https://www.bugsink.com/blog/http2shell-timeline/