3 ms·
How is it not a vulnerability?
by sophacles 3y ago
How is it not a vulnerability?
- jeffbee 3y agoA vulnerability is a flaw in the implementation that allows an attacked to trigger some kind of unexpected result. The result in this case is defined in an RFC. It is 100% working as intended.
- baobabKoodaa 3y agoA protocol can also have a vulnerability (the term is not constrained to implementation flaws only)
- sophacles 3y agoSo your contention is that the creators of HTTP/2 intended for all users of it to be DDoSed?
- joshuamorton 3y agoI mean yes, much as http1 allows for people to be ddosed.
- bobby_the_whale 3y ago[dead]
- tasuki 3y agoWhat is the vulnerability anyway? I skimmed the linked article twice and could find no explanation of how it works, beyond "request, cancel, request, cancel" and that it's called Rapid Reset. Why is HTTP/2 in particular vulnerable? Are all protocols supporting streams vulnerable? How is it possible to vomit such a long article with so little information?
- sophacles 3y agoThe article we're discussing has a link to this deeper description: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://blog.cloudflare.com/technical-breakdown-http2-rapid-...