CRLF is obsolete and should be abolished

Re:CRLF is obsolete and should be abolished by tptacek on Sunday October 13, 2024 @08:24PM (#41832974)

I mean the safest thing would be to send an RST as soon as you see a SYN for 80/tcp.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by theamk on Sunday October 13, 2024 @10:31PM (#41833686)

That would have a severe downside of not letting your customers access your website.

Fast-abort on bare-0ah will still be compatible with all browsers and major http clients, thus providing extra mitigations practically for free.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by RedShift1 on Sunday October 13, 2024 @08:59PM (#41833159)

Wouldn't not replying at all be the safest?

[ Parent | on HN ]