Hadn't thought about the possibility of using http/2 in order to generate race conditions. Nice. Interesting trick. Years ago, Stripe had a capture the flag re

Hadn't thought about the possibility of using http/2 in order to generate race conditions. Nice. Interesting trick. Years ago, Stripe had a capture the flag related to distributed systems (I believe it was the second one they ran). One of the final levels involved attacking a system that would make calls to 3 other systems in turn that each held part of the key before calling back to your webhook. You could tell how many systems it had spoken to by watching for incremented port numbers between the requests. I got killed by the jitter, but I seem to recall someone saying there was a way to stream your requests at a lower lower level on the same socket. Caveat, 10 years ago, details hazy. Found the HN thread from the time though https://news.ycombinator.com/item?id=4453857 https://news.ycombinator.com/item?id=4453857