One Third of the Web Will Stop Working in 4 Days

Re:One Third of the Web Will Stop Working in 4 Days by raincole on Sunday August 03, 2025 @10:03AM (#44776665)

> Hi, I’m the author of this research. It’s great to see interest and I can promise some quality research and a strong argument to kill HTTP/1.1 but the headline of this article goes a bit too far. The specific CDN vulnerabilities have been disclosed to the vendors and patched (hence the past tense in the abstract) – I wouldn’t drop zero day on a CDN!

From the comment section. In other words, click-bait title.

[ Parent | on HN ]

Re:One Third of the Web Will Stop Working in 4 Days by sam_lowry_ on Sunday August 03, 2025 @11:00AM (#44777021)

Killing HTTP/1.1 is killing the open web, because HTTP/2 and HTTP/3 depend on CA infrastructure.

[ Parent | on HN ]

Re:One Third of the Web Will Stop Working in 4 Days by bullen on Sunday August 03, 2025 @11:33AM (#44777267)

I think I figured out a way to do secure registration with a MITM without certificates, so there might be a way out from this mess.

But still you need to transfer the client and check it's hash for it to work and that's hard to implement in practice.

But you could bootstrap the thing over HTTPS (the download of the client) and then not need it ever again which is neat. Specially if you use TCP/HTTP now.

[ Parent | on HN ]

Re:One Third of the Web Will Stop Working in 4 Days by Tohsig on Sunday August 03, 2025 @11:40AM (#44777311)

Appreciate you pointing that out. HTTP/1.1 may be relatively long in tooth, but this particular vulnerability seems straightforward to mitigate to me. Especially at the CDN level.

Following through the links referenced in the article, this appears to be the actual underlying research: https://portswigger.net/research/http-desync-attacks-request...

[ Parent | on HN ]

Re:One Third of the Web Will Stop Working in 4 Days by enknee1 on Sunday August 03, 2025 @11:32AM (#44777262)

Thanks for commenting here! Much appreciate.

[ Parent | on HN ]