CRLF is obsolete and should be abolished

Re:CRLF is obsolete and should be abolished by shadowgovt on Monday October 14, 2024 @09:56AM (#41837585)

And this whole exercise is an example of why this is a non-starter proposal (at least the "change existing implementations" part).

How much do we expect the domain owners to invest in changing an implementation that already works? Hint: it's a number smaller than epsilon.

Google might, but their volume is so high they care about the cost of individual bytes on the wire.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by tptacek on Monday October 14, 2024 @11:57AM (#41838741)

This exercise was about demonstrating that our security can't rely on making sure there's a carriage return in HTTP line termination, because there is no such norm. See the root of the thread, where I asked the question.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by shadowgovt on Monday October 14, 2024 @12:38PM (#41839176)

Oh, I agree it's about that too, but my point is you've already volunteered more time and resources investigating the situation than most companies would be willing to spend.

[ Parent | on HN ]