21–30 of 82 posts
Earlier quoted context omitted.
It took 8 years for somebody to discover this. It can't have been that obvious.
Not everyone cares about Cloudflare, or even HTTP/2. The exploit has more to do with their implementation than the protocol.
Is it? I imagine that implementations can do things like make creating/dropping a stream faster but how would an implementation flat out mitigate this?
Does HTTP/3 suffer from this kind of complexity bloat?
Bit of a leading question since you assuming that this is "complexity bloat" and not just "a feature that people use", but yes, HTTP/3 has streams and so it should be vulnerable.
¿Por qué no los dos?
:)
Earlier quoted context omitted.
Bit of a leading question since you assuming that this is "complexity bloat" and not just "a feature that people use", but yes, HTTP/3 has streams and so it should be vulnerable.
> assuming that this is "complexity bloat" and not just "a feature that people use" ¿Por qué no los dos? :)
Earlier quoted context omitted.
Bit of a leading question since you assuming that this is "complexity bloat" and not just "a feature that people use", but yes, HTTP/3 has streams and so it should be vulnerable.
> assuming that this is "complexity bloat" and not just "a feature that people use" ¿Por qué no los dos? :)
If a lot of people use the thing, it must provide some value to them.
Earlier quoted context omitted.
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
This is the reason you need a security researcher that is actively exploiting things.
Earlier quoted context omitted.
It took 8 years for somebody to discover this. It can't have been that obvious.
Not everyone cares about Cloudflare, or even HTTP/2. The exploit has more to do with their implementation than the protocol.
Does HTTP/3 suffer from this kind of complexity bloat?
Why do I say this? Because it breaks nearly every optimization that's been made to serve content efficiently over the last 25 years (sendfile, TSO, kTLS, etc), and requires that the server's CPU touch every byte of data multiple times (rather than never, for http/1). Its basically the "what if I do everything wrong" case in my talk here: https://people.freebsd.org/~gallatin/talks/euro2022.pdf
Given enough time, it may yet get close to HTTP/1. But its still early days.
Earlier quoted context omitted.
It took 8 years for somebody to discover this. It can't have been that obvious.
Not everyone cares about Cloudflare, or even HTTP/2. The exploit has more to do with their implementation than the protocol.
Earlier quoted context omitted.
Not everyone cares about Cloudflare, or even HTTP/2. The exploit has more to do with their implementation than the protocol.
> The exploit has more to do with their implementation than the protocol. Is it? I imagine that implementations can do things like make creating/dropping a stream faster but how would an implementation flat out mitigate this?