Re: HTTP/2 DoS Vulnerability (Was: HTTP/2 response completed before its request) from Eric J. Bowman on 2014-07-02 (ietf-http-wg@w3.org from July to September 2014)

From: Eric J. Bowman <eric@bisonsystems.net>
Date: Wed, 2 Jul 2014 00:38:41 -0600
To: "Poul-Henning Kamp" <phk@phk.freebsd.dk>
Cc: Roberto Peon <grmocg@gmail.com>, Jeff Pinner <jpinner@twitter.com>, Johnny Graettinger <jgraettinger@chromium.org>, William Chan ( 陈智昌) <willchan@chromium.org>, Martin Thomson <martin.thomson@gmail.com>, Patrick McManus <mcmanus@ducksong.com>, Jesse Wilson <jesse@swank.ca>, HTTP Working Group <ietf-http-wg@w3.org>
Message-Id: <20140702003841.39ce24b01a491aaedf288969@bisonsystems.net>

"Poul-Henning Kamp" wrote:
> 
> Since it seems HTTP/2 is just going to be a short lived stopgap on top
> of TLS only, maybe it will never become a real problem.
> 
> In HTTP/3 we'll have to be serious about it.
> 

My disillusionment with the HTTP/2 process stems from this concept that
it doesn't need to be "gotten right" because we'll address any problems
in HTTP/3. Am I the only one who thinks the horse should come before
the cart?

-Eric

Received on Wednesday, 2 July 2014 06:39:05 UTC