Live data from Hacker News

Some notes about HTTP/3

blog.erratasec.com

121–130 of 181 posts

Re: Some notes about HTTP/3

#121

I’m no web standards expert, but I’m surprised that this standard will be implemented in userspace rather than in the kernel. Seems like a rather odd choice: will there be a way to string together the requisite kernel calls together to achieve the same functionality, or will I be forced to link against a “priveleged” library that makes these calls for me?

To the kernel QUIC is just a UDP socket managed by your application, it's nothing special in that regard.

Re: Some notes about HTTP/3

#122

“The top 5 corporations in the world are, in order, Apple-Google-Microsoft-Amazon-Facebook” I literally can not find a criteria that would support this claim. Market cap - no. Revenue - no. Customer satisfaction? Employee satisfaction? Contribution to society? No.

If you take Facebook out I'm pretty sure the market cap question flips to "true" in which case I'd cut the author some slack.

Re: Some notes about HTTP/3

#123

Earlier quoted context omitted.

Existing HTTP is not in the kernel. If you want to speak HTTP, you already need a library. With existing HTTP, that library needs to handle portability concerns to use TCP on different operating systems. With new HTTP, the library will need to do the same thing but with UDP. Seems like the complexity is no higher, just a difference (TCP vs. UDP) in how your library will interface with the platform network stack API.

Http is done in kernel on Windows http.sys is a kernel driver which IIS and some other windows servers use. Some UNIX distros also have their kernel implementation, and Linux has/had TUX but I’m not sure if it’s in use anywhere.

http.sys is strictly for listening for inbound connections and not a general purpose HTTP API. Amongst other things, it lets multiple applications listen to port 80 on Windows.

Didn't read through this article the whole way, but it was the first I found to share that seemed to give a good overview: https://www.codeproject.com/articles/437733/demystify-http-s...

Re: Some notes about HTTP/3

#124

“The top 5 corporations in the world are, in order, Apple-Google-Microsoft-Amazon-Facebook” I literally can not find a criteria that would support this claim. Market cap - no. Revenue - no. Customer satisfaction? Employee satisfaction? Contribution to society? No.

What does this contribute to the discussion regarding the actual content of the article?

Re: Some notes about HTTP/3

#125

“The top 5 corporations in the world are, in order, Apple-Google-Microsoft-Amazon-Facebook” I literally can not find a criteria that would support this claim. Market cap - no. Revenue - no. Customer satisfaction? Employee satisfaction? Contribution to society? No.

Looking at market cap, for 2018

Q1:

1. Apple

2. Alphabet (Google)

3. Microsoft

4. Amazon

...

8. Facebook

Q2:

1. Apple

2. Amazon

3. Alphabet (Google)

4. Microsoft

5. Facebook.

Q3:

1. Apple

2. Amazon

3. Microsoft

4. Alphabet

...

6. Facebook

https://en.wikipedia.org/wiki/List_of_public_corporations_by...

If you want to quibble that the five listed aren't always the top five or that the order isn't exactly that listed in the article, or that this isn't valid criteria, go ahead, but this seems like a pretty minor point and tangential to the article.

Re: Some notes about HTTP/3

#126
post #8

Earlier quoted context omitted.

Disagree. There's more incentive to move considering the advantages it offers. If anything it feels like people were reluctant to adopt http2 and http3 is a bigger leap that we'll all want to move forward with.

The challenge for http/3 will be middleboxes not endpoints. Put another way: it won't be hard to break 50% of traffic on http/3 but you will still be running 2 10 years from now if you want to reach the last 10% of users.

Middleboxes will only see UDP, no? From their perspective nothing has changed? Isn’t that the whole idea?

Re: Some notes about HTTP/3

#128

Earlier quoted context omitted.

Http is done in kernel on Windows http.sys is a kernel driver which IIS and some other windows servers use. Some UNIX distros also have their kernel implementation, and Linux has/had TUX but I’m not sure if it’s in use anywhere.

http.sys is strictly for listening for inbound connections and not a general purpose HTTP API. Amongst other things, it lets multiple applications listen to port 80 on Windows. Didn't read through this article the whole way, but it was the first I found to share that seemed to give a good overview: https://www.codeproject.com/articles/437733/demystify-http-s...

Yes, http.sys is an http server implemented in the Windows Kernel it’s the http server IIS and all other http based windows services use and has an API for 3rd party servers.

https://docs.microsoft.com/en-us/iis/get-started/introductio...

The point being that there are advantages to implementing a kernel or hybrid mode HTTP server and Microsoft has done it on Windows some other implementations exist but other than MF/Big Unix I’ve never seen them in actual use.

I don’t think there is much of a point of implementing an HTTP client library in the kernel tho since the performance should be an issue really on the client side.

Re: Some notes about HTTP/3

#130
post #37

Most of the deadliest DDoS attacks happen over UDP. Spoofing, reflection and amplification just to name a few. Many businesses just deny UDP to protect themself against the on going DDoS threats. I feel this move won't make internet a better and safer place, but let's see.

That's because other UDP based protocols don't have tcp like sequence numbers or other anti-spoofing measures. Quic has a source address token that makes it hard to spoof.

As far as I understand, the parent's point is that QUIC makes your network vulnerable to attacks from spoofed non-QUIC services because you have to allow UDP packets to reach your network - their usual practice is to protect yourself by just dropping all UDP, but as soon as you want a single system to serve QUIC, then you can't do that anymore and need to inspect all these UDP packages even if it's an extreme amount of some amplified DDoS garbage.
Post reply on HN