3 ms·
> Hi, I’m the author of this research. It’s great to see interest and I can promise some quality research and a strong argument to kill HTTP/1.1 but the headlin
by raincole 1y ago
> Hi, I’m the author of this research. It’s great to see interest and I can promise some quality research and a strong argument to kill HTTP/1.1 but the headline of this article goes a bit too far. The specific CDN vulnerabilities have been disclosed to the vendors and patched (hence the past tense in the abstract) – I wouldn’t drop zero day on a CDN!
From the comment section. In other words, click-bait title.
- sam_lowry_ 1y agoKilling HTTP/1.1 is killing the open web, because HTTP/2 and HTTP/3 depend on CA infrastructure.
- bullen 1y agoI think I figured out a way to do secure registration with a MITM without certificates, so there might be a way out from this mess. But still you need to transfer the client and check it's hash for it to work and that's hard to implement in practice. But you could bootstrap the thing over HTTPS (the download of the client) and then not need it ever again which is neat. Specially if you use TCP/HTTP now.
- enknee1 1y agoThanks for commenting here! Much appreciate.
- Tohsig 1y agoAppreciate you pointing that out. HTTP/1.1 may be relatively long in tooth, but this particular vulnerability seems straightforward to mitigate to me. Especially at the CDN level. Following through the links referenced in the article, this appears to be the actual underlying research: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn https://portswigger.net/research/http-desync-attacks-request...