Viewing profile — patrickmcmanus

The IETF WG DBOUND tried to find a better solution to this problem and did not reach any consensus. fwiw. https://datatracker.ietf.org/wg/dbound/about/ The current way most of this…

a 1 yen coin has a mass of 1 gram - which can be handy for measuring stuff.

absolutely! and some eTLDs are preloaded (like .dev) already and that of course applies to the domains registered in them - which is a nice property.

you're thinking of an exploit in spdy (the h2 predecessor) in which the headers were just run through the same gzip context. The HPACK format in h2 and h3 is meant to remove those …

protecting against the zero-bound is the value - that's not a scam. As the ratio of potential loss to net worth drops, that's less interesting and so is the insurance. Varying leve…

I think we'll see some DNS version of alt-svc that doesn't require TCP to bootstrap.. see httpssvc and svcb

websockets is carried on TCP. Often bootrstapped on HTTPS tcp/443.

preamble of chunk length and 1 bit for end-of-message indicator.. if you only do chunk length you will eventually find you can't stream but want to. or just use http.

the author is writing, in that section, about blind (i.e. off path) attacks. Given the attacker in that model is off-path they don't see the challenge ack.

QUIC is considerably more resilient than TCP to RST attacks because it authenticates the transport itself once the handshake is complete.

The way I look at it a lot of what we logically think of as the network layer often exists in userspace anyhow. That's the point of DPDK/snabb/netmap and other kinds of driver bypa…

tl;dr; congestion control is basically pluggable. Much like in TCP, congestion control really isnt something required for interoperation between peers. Given the userspace nature o…

These are essentially seperable features - and given that QUIC is at a later stage than ESNI there is not a compelling reason to create a blocker to getting an open QUIC standardiz…

corollary question - if DNS data is not authenticated then how does the client distinguish between police and attackers? much better to authenticate the policer.

as they say - there are many reasons a company can succeed, but they all fail for the same reason. (they run out of money). So cash is king - follow the signs of cash flow. #1 - wa…

the post is good.. but also: confidentiality matters. Think about a library. There are no secrets in the stacks that need to be kept from public disclosure. What is secret is the a…

That was one of my favorite Mozilla Open Source Support projects!

restricted to: "solely to improve the performance of Cloudflare Resolver for Firefox and to assist us in debugging efforts if an issue arises"

The counterpoint is that traditional DNS has horrendous loss recovery and basically no congestion control and these things definitely benefit DoH at the tail. QUIC will let us have…