Re: Prague side meeting: HTTP/2 concurrency and request cancellation (CVE-2023-44487)

The HTTP archive has been counting total requests per page for years. The
dataset has its own caveats  and the number doesn't represent concurrent
requests. As of Sept 1 the median is 72 requests on desktop, 67 requests on
mobile. The p90s are 173 desktop and 161 mobile.

Source: https://httparchive.org/reports/state-of-the-web#reqTotal

On Fri, 13 Oct 2023, 12:36 Poul-Henning Kamp, <phk@phk.freebsd.dk> wrote:

> --------
> Stefan Eissing writes:
>
> > > Does any published data exist on how "100" relates to how many streams
> > > real-life legit clients /actually/ open on a new H2 connection ?
> >
> > See >
> https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
> >
> > They tried to lower it and found a page where browsers do open 100
> > requests right away.
>
> Yes, already saw that.
>
> But 100 is not a hard limit, it is barely even guidance, so I wonder
> what the actual, legit, in use in the wild, maximum is ?
>
> 100 ?  200 ?  1000 ?
>
> It would be nice if we had some actual statistics to guide us, rather
> than justing picking 100 out of the blue ?
>
> --
> Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
> phk@FreeBSD.ORG         | TCP/IP since RFC 956
> FreeBSD committer       | BSD since 4.3-tahoe
> Never attribute to malice what can adequately be explained by incompetence.
>
>

Received on Friday, 13 October 2023 11:43:02 UTC