Optionsbleed – HTTP OPTIONS method can leak Apache's server memory

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by runako on Monday September 18, 2017 @11:14AM (#15276623)

According to Netcraft, 21% of the sites on the public Internet run Apache:

There are lots of legit reasons to run Apache:

- it works like a champ

- it's widely known

- it's got a big ecosystem (plugins, etc.)

- it has a fairly complete WebDAV implementation

- it's widely supported

TL;DR "legacy" sometimes means "good" and not just "old."

[ Parent | on HN ]

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by pmlnr on Monday September 18, 2017 @11:16AM (#15276642)

Yeah, right. It's also still prone to slowloris and you can take down a shared hosting server with a laptop in a coffee store.

In this case legacy is either "I don't know anything else", "well it worked so far" or "meh".

[ Parent | on HN ]

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by hannob on Monday September 18, 2017 @11:32AM (#15276781)

Apache has mod_reqtimeout which mitigates the slowloris-attack. It's been a while, but in my tests that worked pretty well.

[ Parent | on HN ]

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by xorcist on Monday September 18, 2017 @01:13PM (#15277660)

This is your second comment that mentions slowloris. You know slowloris isn't specific to Apache, right?

[ Parent | on HN ]

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by pmlnr on Monday September 18, 2017 @05:59PM (#15280045)

I know.

[ Parent | on HN ]