News for hackers. Stuff that matters.

A comment on The novel HTTP/2 'Rapid Reset' DDoS attack. Parent comment

Re:The novel HTTP/2 'Rapid Reset' DDoS attack by bsder on Tuesday October 10, 2023 @06:34PM (#37838595)
SCTP (Stream Control Transmission Protocol) or the equivalent. HTTP is really the wrong layer for things like bonding multiple connections, congestion adjustments, etc.

Unfortunately, most computers only pass TCP and UDP (Windows and middleboxes). So, protocol evolution is a dead end.

Thus have to piggyback on what computers will let through--so you're stuck with creating an HTTP flavor of TCP.

[ Parent | on HN ]
Re:The novel HTTP/2 'Rapid Reset' DDoS attack by murderfs on Tuesday October 10, 2023 @11:13PM (#37840479)
QUIC (the basis for HTTP/3) is basically the spiritual successor to SCTP, except with TLS baked in, so compared with SCTP+DTLS, connection establishment requires significantly fewer roundtrips (0 round trips for session resumption, 1 roundtrip at worst, compared to 4 or so for DTLS).
[ Parent | on HN ]