News for hackers. Stuff that matters.

A comment on HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections. Parent comment

Re:HTTP/2-exclusive threats caused by implementation flaws a... by darkwater on Friday August 06, 2021 @03:49AM (#28084357)
Yeah but serving traffic from an application server directly is probably even worse in plethora of other failure modes.

EDIT: and yes I understand that you should use http/2 on the LB and http/2 on the backend to get the best of both worlds.

EDIT2: anyway my opinion is that the general reaction to a security discovery like this one shouldn't be "let's stop using this tech immediately" but "let's get this patched ASAP"

[ Parent | on HN ]
Re:HTTP/2-exclusive threats caused by implementation flaws a... by takeda on Friday August 06, 2021 @04:23AM (#28084542)
No one was talking about serving from application directly. The issue is in scenario you are describing. Please read the article.
[ Parent | on HN ]