7 ms·
Apache HTTP Server 2.4.58 (CVE fixes)
- skilled 3y agoRelevant, HTTP/2 Rapid Reset and Apache https://github.com/icing/blog/blob/main/h2-rapid-reset.md https://github.com/icing/blog/blob/main/h2-rapid-reset.md Apache httpd 2.4.58 https://github.com/icing/blog/blob/main/httpd-2.4.58.md https://github.com/icing/blog/blob/main/httpd-2.4.58.md
- deleted 3y ago[deleted]
- teddyh 3y agoPrevious discussions: <https://news.ycombinator.com/item?id=37830987 https://news.ycombinator.com/item?id=37830987> <https://news.ycombinator.com/item?id=37830998 https://news.ycombinator.com/item?id=37830998> <https://news.ycombinator.com/item?id=37831004 https://news.ycombinator.com/item?id=37831004>
- dang 3y agoThanks! Macroexpanded: HTTP/2 Rapid Reset: deconstructing the record-breaking attack - https://news.ycombinator.com/item?id=37831004 https://news.ycombinator.com/item?id=37831004 - Oct 2023 (23 comments) HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks - https://news.ycombinator.com/item?id=37830998 https://news.ycombinator.com/item?id=37830998 - Oct 2023 (71 comments) The novel HTTP/2 'Rapid Reset' DDoS attack - https://news.ycombinator.com/item?id=37830987 https://news.ycombinator.com/item?id=37830987 - Oct 2023 (106 comments)
- eightnoneone 3y ago[flagged]
- javaunsafe2019 3y agoBecause they keep rules you obviously don’t understand and know
- reportgunner 3y agoTo make it look the same everywhere.
- blueflow 3y agoWhats wrong with that? I find it convenient to read with less.
- SkyPuncher 3y agoWell, for one, in a mobile screen I can understand the difference between line wraps and new lines.
- tehbeard 3y agoTo be a bit less vitrolic than other comments. The link is to a plain text file. The indentation is formatting to give a clear delineation between various sections, such as each feature/fix/item of the changelog. Which makes it easier to read rather a run along blob of text with no clear markers. You see this same indentation with un/ordered lists in HTML or word documents.
- abfaqb 3y ago[flagged]
- m00dy 3y agofor PoC in Rust, https://github.com/m00dy/r4p1d-r3s3t https://github.com/m00dy/r4p1d-r3s3t
- blind_oracle 3y agoI'm surprised people still actively use it and it seems on par with nginx, at least according to https://www.netcraft.com/blog/january-2023-web-server-survey/ https://www.netcraft.com/blog/january-2023-web-server-survey...
- 1over137 3y agoI'm surprised you're surprised. It's a good web server.
- badcppdev 3y agoI'm surprised HN hasn't added a feature where if you start a comment with "I'm surprised" it asks you to tick a box to confirm that you're really sure you're contributing to the discussion.
- nontiko 3y agoUsually when I’m surprised about something, I realize that I am uninformed or out of touch.
- bityard 3y agoI am strongly in favor of this. I would also like HN to implement a warning that your comment may be extremely uninteresting if it starts out with, "Unfortunately..." or, "Can we all just agree that..."
- supriyo-biswas 3y agoAlso some of the snide comments beginning with “lol” and “I didn’t ask you”.
- bewuethr 3y agoI've found the experience when people are explicitly requested to never do this (feign surprise) to be excellent; for example, Recurse Center: https://www.recurse.com/manual#sub-sec-social-rules https://www.recurse.com/manual#sub-sec-social-rules
- secondcoming 3y agoIs HTTP/2 just too complex for a mere mortal to implement?
- gustavus 3y agoSounds like the OAuth2 spec.
- nijave 3y agoI don't think this has too much to do with the spec and more about discovering and preventing DoS vectors.
- pornel 3y agoAlso HAProxy managed to predict and mitigate this issue 5 years ago.
- deleted 3y ago[deleted]
- supriyo-biswas 3y agoNo, but QUIC definitely falls in the overly complicated category, spanning multiple, large RFCs. This attack is just about failing to enforce the negotiated parameters during the start phase of the connection.
- mnot 3y ago
- nologic01 3y ago"The early Apache server was a big hit, but we all knew that the codebase needed a general overhaul and redesign." From the README of the apache_1.3.0 distribution (April 1998) https://archive.apache.org/dist/httpd/ https://archive.apache.org/dist/httpd/ Love this project. It changed the world and it still goes strong. The closest to "forever software"?
- seabrookmx 3y agoUp there with gcc and OpenSSH.
- Yhippa 3y agoA Patchy Server has come such a long way.
- zeroimpl 3y agoSurprising to see stuff like this included in a patch release: core: Updated conf/mime.types: - .js moved from 'application/javascript' to 'text/javascript' That’s probably going to break something for somebody.