The Several Million Dollar Bug

Re:The Several Million Dollar Bug by pbhjpbhj on Monday June 09, 2014 @11:28AM (#7868878)

Surely reading the responses opens the browser up to active exploit whilst simply buffering unrequested "responses" allows the possibility of denial of service by filling the buffer and causing actively requested packets to be refused.

So, presumably if someone requests anything from your site you can keep bombarding their browser with unrequested content that will get queued. As jacquesm indicates having an array of connections with reserved queues would avoid this blocking requested content.

[ Parent | on HN ]

Re:The Several Million Dollar Bug by colanderman on Monday June 09, 2014 @12:39PM (#7869176)

In the OS, the buffers are per TCP connection. Only packets destined for the full buffer are dropped. TCP connections can't be opened by a remote attacker unless the browser is actively listening for them.

So effectively all that can happen is a website can DoS the connection to itself.

(Yes, an attacker can try to initiate many many TCP connections. This uses much fewer resources than an actual HTTP session would but can still be an effective DoS attack. This is known as a SYN flood.)

[ Parent | on HN ]