>HTTP/2 protocol — a fundamental protocol that is critical to how the Internet and all websites work
No, it isn't. This whole article seems more like a marketing sales pitch than a disclosure.
HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
51–60 of 82 posts
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#52>HTTP/2 protocol — a fundamental protocol that is critical to how the Internet and all websites work No, it isn't. This whole article seems more like a marketing sales pitch than a disclosure.
I visited a few common sites and they seem to use HTTP/2. I'm not sure the point of arguing it's not fundamental, a cursory glance shows HTTP/1 is bottlenecked by not being able to use the same TCP connection to serve multiple resources (something HTTP/2 fixes)? Is there ire against HTTP/2 adoption, and for what reasons?
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#53>HTTP/2 protocol — a fundamental protocol that is critical to how the Internet and all websites work No, it isn't. This whole article seems more like a marketing sales pitch than a disclosure.
I visited a few common sites and they seem to use HTTP/2. I'm not sure the point of arguing it's not fundamental, a cursory glance shows HTTP/1 is bottlenecked by not being able to use the same TCP connection to serve multiple resources (something HTTP/2 fixes)? Is there ire against HTTP/2 adoption, and for what reasons?
I'm not an area expert, but common issues raised over the years:
- HTTP/2 as implemented by browsers requires HTTPS, and some people don't like HTTPS.
- HTTP/2 was "designed by a committee" and has: a lot of features and complexity; most of those features were never implemented by most of the servers/clients; most of those advanced features that were implemented were very naive "checkbox implementations" and/or buggy [0]; some were implemented and then turned out to be more harmful than useful, and got dropped (HTTP/2 push in browsers [1]) etc.
[0] https://github.com/andydavies/http2-prioritization-issues
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#54>HTTP/2 protocol — a fundamental protocol that is critical to how the Internet and all websites work No, it isn't. This whole article seems more like a marketing sales pitch than a disclosure.
I visited a few common sites and they seem to use HTTP/2. I'm not sure the point of arguing it's not fundamental, a cursory glance shows HTTP/1 is bottlenecked by not being able to use the same TCP connection to serve multiple resources (something HTTP/2 fixes)? Is there ire against HTTP/2 adoption, and for what reasons?
http 1.1 connections can be reused, including with pipelining, and it can open multiple sockets to make requests in parallel. http 2 allows out of order responses on one socket. is it worth the complexity? http 1.1 is over 20 years old and battle tested.
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#55A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
[deleted]
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#56>HTTP/2 protocol — a fundamental protocol that is critical to how the Internet and all websites work No, it isn't. This whole article seems more like a marketing sales pitch than a disclosure.
[deleted]
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#57tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
[deleted]
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#58This seems like a hyperbolic misuse of both “vulnerability” and “zero-day”.
[deleted]
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#59Earlier quoted context omitted.
How is it not a vulnerability?
A vulnerability is a flaw in the implementation that allows an attacked to trigger some kind of unexpected result. The result in this case is defined in an RFC. It is 100% working as intended.
So your contention is that the creators of HTTP/2 intended for all users of it to be DDoSed?
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#60Earlier quoted context omitted.
A vulnerability is a flaw in the implementation that allows an attacked to trigger some kind of unexpected result. The result in this case is defined in an RFC. It is 100% working as intended.
So your contention is that the creators of HTTP/2 intended for all users of it to be DDoSed?
I mean yes, much as http1 allows for people to be ddosed.