4 ms·
There's a reply in that Twitter Thread. Go will be switching to ASCII: "Thanks for the ping. Our policy is that anything that requires a proxy to forward an inv
by _wldu 6y ago
There's a reply in that Twitter Thread. Go will be switching to ASCII: "Thanks for the ping. Our policy is that anything that requires a proxy to forward an invalid Transfer-Encoding header is a vulnerability in the proxy, not in the server. We are planning to switch all net/http to ASCII strings functions anyway for defense in depth and correctness." - Filippo Valsorda, Go Security Lead
- lucideer 6y ago> Our policy is that anything that requires a proxy to forward an invalid Transfer-Encoding header is a vulnerability in the proxy It's great that they're fixing this anyway, but that's a bad policy.
- jeff-davis 6y agoThat was my initial reaction as well, but I'd like to hear some more explanation.