3 ms·
I can't wait for all the HTTP/3 -> HTTP/2 -> HTTP/1 tunneling and other exploits that will appear in all the rushed implementations. We already saw how that wor
by josefx 5y ago
I can't wait for all the HTTP/3 -> HTTP/2 -> HTTP/1 tunneling and other exploits that will appear in all the rushed implementations. We already saw how that worked with HTTP/2 and people tried to rush OpenSSL into adopting an experimental implementation of QUIC while Google was still hashing out the spec. .
I would suggest disabling HTTP/3 for the next 10 or so years and give everyone else the chance to burn through the exploits.
- johncolanduoni 5y agoThankfully HTTP/3 didn’t change request/header semantics much from HTTP/2, at least nowhere near the level of the HTTP/1 -> HTTP/2 changes.