HTTP/2 Denial of Service Advisory

Re:HTTP/2 Denial of Service Advisory by byuu on Wednesday August 14, 2019 @01:16AM (#20692874)

I feel like the technical merits are overshadowed by the elephant in the room: modern sites are slow because to render a 10 KiB article, they're loaded with 5 MiB of Javascript libraries, 85 separate resource requests, offsite ad network and affiliate link requests, streaming video popup players, and on and on. In light of that, is it really that important to eg compress HTTP headers?

We should definitely still improve upon HTTP, no question, but I hope that we don't end up having HTTP/1.x force-deprecated through tactics like search page derankings. HTTP/1.x is a workhorse. Even if you really shouldn't, there's something to be said about being able to create a client or server for it in ~100 lines of code that'll work in 99% of non-edge cases. I'd hate for us to lose that as an option for simpler applications.

[ Parent | on HN ]

Re:HTTP/2 Denial of Service Advisory by parliament32 on Thursday August 15, 2019 @01:43PM (#20707619)

Agreed, with HTTP/2 we're treating the symptoms, not the problem. Unfortunately there's no nice way to fix this: users don't blame sites, it's "my internet is slow".

I've never been one to advocate NoScript but it's getting more and more appealing by the day.

[ Parent | on HN ]