News for hackers. Stuff that matters.

lucaspardue

Re:HTTP/3: the past, the present, and the future on Thursday September 26, 2019 @12:30PM (#21082624)
Nice overview!

There is a draft [1] that would support Alt-Svc in DNS. Lots to consider there but it is being presented to IETF.

[1] - https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc...

Re:HTTP/3: the past, the present, and the future on Thursday September 26, 2019 @12:04PM (#21082320)
We use HTTP Alternative Services (RFC 7838). This appears as a Alt-Svc response header that advertises the availability of HTTP/3 to a client.

The client uses its local knowledge (and maybe other heuristics) to decide if it wants to change protocols.

Re:HTTP/2 Denial of Service Advisory on Wednesday August 14, 2019 @06:00AM (#20694028)
Multiplexing is beneficial, otherwise we'd never have seen HTTP user agents opening up multiple TCP connections.

The gain of moving to binary was the ability to multiplex multiple requests is a single TCP connection. It also fixes a whole class of error around request and response handling - see the recent request smuggling coverage from Blackhat [1].

HTTP/2 isn't perfect but I dont buy that HTTP/1.1 is the ideal simple protocol. There are a ton of issues with its practical usage and implementation.

We live in complex times and the threat models are constantly advancing. Addressing those requires protocols that by their nature end up more complex. The "simple" protocols of the past weren't designed under the same threat models.

[1] https://portswigger.net/blog/http-desync-attacks-request-smu...

Re:HTTP/2 Denial of Service Advisory on Tuesday August 13, 2019 @08:03PM (#20691477)
Versions prior to HTTP/2 give the appearance of being simple but in actuality there are many many edge cases that also are the cause of vulnerabilities.

HTTP/2's binary syntax addresses some of those edge cases mainly through better-formed header fields and a common chunking of body data.

SCTP is undeployable on the Internet. HTTP/2 is deployed on the Internet. It brings multiplexing and of course that brings some additional complexity and constraints. But these have proven more deployable than HTTP/1.x-style solutions such a pipe lining.

HTTP/3 is actually a simpler application mapping than HTTP/2. This is due to the complexity getting pulled into the transport. But it's a zero sum game, just moving the concerns around doesn't mean they are automatically fixed.

Re:Better HTTP/2 Prioritization for a Faster Web on Friday May 17, 2019 @09:32AM (#19939407)
This depends on how the proxy is configured to behave. One common pattern is to have a protocol terminating proxy talk to the client. Other component(s) sit behind this and they could be other parts of the system, tiers of caches or tiers of CDNs.

Even if the proxy does cache locally to memory or disk. Without infinite space, there will be some chance of cache eviction and a need to fetch from the upstream again.

Our scenarios are different ends of a broad spectrum, and there's a lot in between. Which is why getting prioritisation right is a hard nut to crack.

Re:Better HTTP/2 Prioritization for a Faster Web on Thursday May 16, 2019 @07:11AM (#19927864)
These papers are interesting, thanks for sharing.

However, the primary axiom is of a web server that is serving static content that is located on the device. That, in a sense, gives almost infinite time and knowledge to deciding prioritisation of work.

For HTTP proxies that have to fetch resources from some other server, the time and knowledge window becomes much shorter. Decision making needs to be done quickly in order to minimise the latency of returning anything. And the upstream server may response in unexpected ways.

This is the challenge for today's CDN deployments. And developing a solution that works for the huge variety of how websites are developed is the really interesting bit.

Re:HTTP/3: from root to tip on Monday January 28, 2019 @09:45AM (#19017740)
There is still a place for WebSockets in HTTP/2. The fairly recent RFC 8441 defines a mechanism to reserve a single HTTP/2 stream for bidirectional WebSockets.

It is feasible for a similar mechanism for also work for HTTP/3, just no-one has gone to the effort yet.

https://tools.ietf.org/html/rfc8441

Re:HTTP/3: from root to tip on Monday January 28, 2019 @01:19AM (#19015619)
Do you mean forward proxies? The HTTP/3 draft currently specifies how the CONNECT method is used. At present, it only allows you to create an onward TCP connection. So you have a QUIC connection between client and proxy, and a TCP connection between proxy and server. Like so

        QUIC         TCP
client <----> proxy <----> server

Unfortuantely, this means that a HTTP/3 client has to tunnel HTTP/1.1 or HTTP/2 to the target server. I realised this was a shortcoming last year and prepared an I-D called HiNT that explores the problem space and some candidate solutions:

https://datatracker.ietf.org/doc/draft-pardue-httpbis-http-n...

This was presented, along with some nicer tunnel diagrams, at the IETF 102 meeting. Slides in pdf: https://github.com/httpwg/wg-materials/blob/gh-pages/ietf102...