11–20 of 82 posts
A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
Earlier quoted context omitted.
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
It took 8 years for somebody to discover this. It can't have been that obvious.
The exploit has more to do with their implementation than the protocol.
Earlier quoted context omitted.
It took 8 years for somebody to discover this. It can't have been that obvious.
Not everyone cares about Cloudflare, or even HTTP/2. The exploit has more to do with their implementation than the protocol.
A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
My problem is that it often seems like significant complexity is added in order to chase marginal performance gains. I suppose performance is relatively easy to measure while complexity is not.
Does HTTP/3 suffer from this kind of complexity bloat?
A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
It reminds me of Meltdown/Spectre: you have a pipe, and instructions need to flow through it in a single file line. Let's increase performance by allowing things to be sent/processed out-of-order!
tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
Sticking with HTTP/2, or going with grpc/similar is also possible. It depends on which corner of the Internet you inhabit. (Cloudflare isn't the whole Internet, yet)