Re: Prague side meeting: HTTP/2 concurrency and request cancellation (CVE-2023-44487)

On Thu, Oct 12, 2023, at 16:23, Glenn Strauss wrote:
> How might I convince you to change the guidance, which is "recommended"
> and not "MUST"? :)

You don't convince *me*, you convince the working group.

See https://youtu.be/xuaHRN7UhRo?si=TNbX8HGPZteqmYNp

> Intent: I posted with the hope that along with the potentially new
> MAX_STREAMS, that the guidance for SETTINGS_MAX_CONCURRENT_STREAMS
> can also be updated.

To set some expectations here. I wish that our processes were more amenable to making small changes, but they aren't.

Updating an RFC is far more onerous than it should be, but there is a necessary amount of work as well that is still non-trivial.  An RFC captures the agreement of a community of people and an update has to also capture a similar degree of agreement.  Practically speaking, that means convincing this working group as a whole that a change is justified.

But in justifying that change, you aren't just arguing that a 100 should be a 10 (or whatever), you are also arguing that we need to go through the entire process of updating an RFC.  That means not just agreeing that 10 is better than 100, but also agreeing that all the work necessary to draft and publish a revised RFC is also worth it because that 10 is that much better than the 100.

As you might expect, a change here isn't cheap and it's likely that the cost is just too high.

Received on Thursday, 12 October 2023 05:36:22 UTC