4 ms·

I dont know, arguing that http/2 is safer overall is a... bold claim. It is sufficiently complex that there is no standard implementation in the Python standard

I dont know, arguing that http/2 is safer overall is a... bold claim. It is sufficiently complex that there is no standard implementation in the Python standard library, and even third party library support is all over the place. requests doesn't support it; httpx has experimental, partial, pre-1.0 support. Python http/2 servers are virtually unavailable at all. And it's not just Python - I remember battling memory leaks, catastrophic deadlocks, and more in the grpc-go implementation of http/2, in its early days. HTTP 1.1 connection reuse is indeed more subtle than it first appears. But http/2 is so hard to get right.

jcdentonn 1y ago
Not sure about servers, but we had http/2 clients in java for a very long time.
cyberax 1y ago
An HTTP/2 client is pretty easy to implement. Built-in framing automatically improves a lot of complexity, and if you don't need multiple streams, you can simplify the overall state machine. Perhaps something like "HTTP/2-Lite" profile is in order? A minimal profile with just 1 connection, no compression, and so on.
- spenczar5 1y ago
  Isn't the original post about servers? A minimal client doesn't help with server security. I would endorse your idea, though, speaking more broadly! That does sound useful.
jiehong 1y ago
nghttp2 is a C lib that can be used for serving as a server in many cases. Rust has the http2 crate. Perhaps it isn’t that easy, but it could be put in common and used a bit everywhere.
ameliaquining 1y ago
These sound to me like they are mostly problems with protocol maturity rather than with its fundamental design. If hypothetically the whole world decided to move to HTTP/2, there'd be bumps in the road, but eventually at steady state there'd be a number of battle-tested implementations available with the defect rates you'd expect of mature widely used open-source protocol implementations. And programming language standard libraries, etc., would include bindings to them.
Bender 1y ago
Speaking of http/2 [1] - August 14, 2025 The underlying vulnerability, tracked as CVE-2025-8671, has been found to impact projects and organizations such as AMPHP, Apache Tomcat, the Eclipse Foundation, F5, Fastly, gRPC, Mozilla, Netty, Suse Linux, Varnish Software, Wind River, and Zephyr Project. Firefox is not affected. [1] - https://www.securityweek.com/madeyoureset-http2-vulnerability-enables-massive-ddos-attacks/ https://www.securityweek.com/madeyoureset-http2-vulnerabilit...
- yencabulator 1y ago
  Protocol smuggling is a lot more severe than DoS.

jcdentonn 1y ago

Not sure about servers, but we had http/2 clients in java for a very long time.

cyberax 1y ago

An HTTP/2 client is pretty easy to implement. Built-in framing automatically improves a lot of complexity, and if you don't need multiple streams, you can simplify the overall state machine. Perhaps something like "HTTP/2-Lite" profile is in order? A minimal profile with just 1 connection, no compression, and so on.

spenczar5 1y ago
Isn't the original post about servers? A minimal client doesn't help with server security. I would endorse your idea, though, speaking more broadly! That does sound useful.

jiehong 1y ago

nghttp2 is a C lib that can be used for serving as a server in many cases. Rust has the http2 crate. Perhaps it isn’t that easy, but it could be put in common and used a bit everywhere.

ameliaquining 1y ago

These sound to me like they are mostly problems with protocol maturity rather than with its fundamental design. If hypothetically the whole world decided to move to HTTP/2, there'd be bumps in the road, but eventually at steady state there'd be a number of battle-tested implementations available with the defect rates you'd expect of mature widely used open-source protocol implementations. And programming language standard libraries, etc., would include bindings to them.

Bender 1y ago

Speaking of http/2 [1] - August 14, 2025 The underlying vulnerability, tracked as CVE-2025-8671, has been found to impact projects and organizations such as AMPHP, Apache Tomcat, the Eclipse Foundation, F5, Fastly, gRPC, Mozilla, Netty, Suse Linux, Varnish Software, Wind River, and Zephyr Project. Firefox is not affected. [1] - https://www.securityweek.com/madeyoureset-http2-vulnerability-enables-massive-ddos-attacks/ https://www.securityweek.com/madeyoureset-http2-vulnerabilit...

yencabulator 1y ago
Protocol smuggling is a lot more severe than DoS.