icing, to random
@icing@chaos.social avatar

Roy Fielding weighs in on the handling of the HTTP/2 Rapid Reset attack vector: https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0068.html

slink,
@slink@fosstodon.org avatar

@icing for reach

itnewsbot, to security

Biggest DDoSes of all time generated by protocol 0-day in HTTP/2 - Enlarge (credit: Aurich Lawson / Getty)

In August and Septembe... - https://arstechnica.com/?p=1975840 #distributeddenialofserviceattack #security #biz#http/2 #ddos

icing, to random
@icing@chaos.social avatar

Follow-up on the HTTP/2 Rapid Reset Exploit: NGINX also describes the mechanism they have in place to prevent this.

Google and Cloudflare should have written "the typical web server is not affected, but the typical Cloud implemenetation is."

Blaming the exploit on the protocol standard is lame.

When you implement 100% of an RFC you are not done with your work.

https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0033.html

slink,
@slink@fosstodon.org avatar

@icing while i agree that implementations should interpret standards intelligently and possibly diverge where justified, i do not understand why it was "lame" to point out that the spdy to "gold plating" process brushed over a lot of feedback and controvercies.
🧵

schizanon, (edited ) to webdev

> You can't get faster than No Build

"The state of the art is no longer in finding more sophisticated ways to build JavaScript or CSS. It's not to build at all. To lean on HTTP/2 and the now universal support for import maps to avoid bundling."

https://world.hey.com/dhh/you-can-t-get-faster-than-no-build-7a44131c

heisec, to news German

Rapid Reset: Angreifer nutzten Lücke in HTTP/2-Protokoll seit August 2023 aus

Eine DDoS-Sicherheitslücke mit Rekordvolumen im HTTP/2-Protokoll gefährdet unzählige Server. Erste Sicherheitspatches sind verfügbar.

https://www.heise.de/news/Rapid-Reset-Angreifer-nutzten-Luecke-in-HTTP-2-Protokoll-seit-August-2023-aus-9330889.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege

#HTTP #Sicherheitslücken #news

slink, to random German
@slink@fosstodon.org avatar

zu
https://blog.fefe.de/?ts=9bdb4a0e
Außerdem ist HTTP/2 eine Google-Erfindung. Google versucht hier also einen Heldenmythos zu etablieren, in dem sie uns vor dem Monster retten, das sie selbst geschaffen haben. Ohne den Teil zu erwähnen, dass sie das Monster geschaffen haben. Zum Kotzen, diese Tech Bros immer.

raptor, to random
vile, to random

figured this was worth crossposting to here original post

kkarhan,

@eater @da_667 yes - sames as with #BitTorrent...
https://github.com/greyhat-academy/lists.d/blob/main/largefiles.downloads.links.list.tsv

Saying #IPFS has no legitimate use is completely absurd and would rather apply to #FTP, #HTTP / #HTTPS, #DNS and espechally #eMail since #Spamming exists.
https://github.com/greyhat-academy/lists.d/tree/main

DiazCarrete, (edited ) to random
@DiazCarrete@hachyderm.io avatar

currently engaged in a RESTological disquisition

Why isn't HTTP PUT allowed to do partial updates in a REST API?
🔗 https://stackoverflow.com/questions/19732423/why-isnt-http-put-allowed-to-do-partial-updates-in-a-rest-api

Why PATCH is neither safe nor idempotent?
🔗 https://stackoverflow.com/questions/41390997/why-patch-is-neither-safe-nor-idempotent

Same representation for GET and PUT?
🔗 https://stackoverflow.com/questions/36498982/same-representation-for-get-and-put

I might even consult the holy RFCs themselves
🔗 https://developer.mozilla.org/en-US/docs/Web/HTTP/Resources_and_specifications

#rest #http

DiazCarrete,
@DiazCarrete@hachyderm.io avatar

I might be splitting hairs about the semantics of PUT, but there seems to be a slight contradiction in

On one hand, a GET after a PUT should return the exact representation that was set by the PUT.

On the other hand, a PUT "might also cause links to be added between the related resources" which seems to say that the representation might be enriched with extra links.

technotramp, to SanFrancisco

The IPFS in has ! This is thanks to you who are using the set up on the .com domain. Thanks to , part of the with for RPlayer is also in this . you very much for that! It's live in , where it's of . of data where the , and ... It's .

Listen.: https://technotramp.com

🖐️😶

technotramp, to ipfs

#Friends and #comrades,

although I hate to, I have redirected the #domain #technotramp.com for those who don't use #IPFS to "https://bafybeiewkxwysf4jlnhbxs7pd4junvkrrais76qm3qgkpn3en4b2lcqxwm.ipfs.dweb.link/index.htm". I apologize that you will be #reloading #data from IPFS into the #cache. But it will #work #fine in the end if #you #want ;-) A... #Thanks indeed for letting me be with you in the #land of #music.

Don't forget...: "xwm".

👆

https://technotramp.com

Now look below. 🖐️😉

👇

technotramp,

The #player of the #future will have to be a #native #application. Now mainly because of #Apple and their #limitations. However, the new #bootloader version of the upcoming #RMusic app will already #handle #it. #HTTP #gateways for #IPFS unfortunately #amplify the #disadvantages of both #technologies. Nothing can be done about it.

🖐️😶

iamkale, to random

"Where did all of my followers go? I can't find ANY of them!!"

slaps knee

starts laughing

laughs till he's wheezing

#BadDadJokes #http

melroy, to programming
@melroy@mastodon.melroy.org avatar

I wrote a new blog article! It's about Bun; the pros and cons, Check it out now:
https://blog.melroy.org/2023/bun-v1.0/

jnv, (edited ) to til
@jnv@mastodon.social avatar

#TIL that the (in)famous “418 I'm a teapot” status code was never intended for HTTP, but only for Hyper Text Coffee Pot Control Protocol (which aimed to humorously illustrate how HTTP is being abused). So the majority of libraries include this status code by mistake and getting rid of it would be a breaking change… https://www.rfc-editor.org/rfc/rfc9110.html#name-418-unused
#HTTP #HTCPCP #HTTP418 #RFC2324

gabrielesvelto, to random
@gabrielesvelto@fosstodon.org avatar

I'm very grumpy about #HTTP response status code 429 AKA "Too many requests".

It tells you absolutely nothing except that you've been sending too many requests. Sure, but how many are too many? Trial-and-error only gets you so far, and if things change down the line you're back to square one.

I wish we had a way to ask for throttling limits - or even better - if the server-side would respond slowly instead, until you're back below the limit.

jonspark, to TodayILearned
@jonspark@howdee.social avatar

Today I Learned what an HTTP 307 does that's subtly different from other redirect responses and that a NextJS res.redirect() uses it by default.

The 307 redirects to the new URL with the same request method (in my case POST). I was redirecting a form submit to an OAuth authorisation URL. Switching to an HTTP 303 swaps the method to GET and has sorted things out.

Took a bit to figure that one out! 😅

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307

#TodayILearned #TIL #NextJS #HTTP

prx, to random
@prx@im-in.space avatar

Pensée désagréable du jour: le protocole #gemini n'est pas écologique car il n'est pas accessible sur du vieux matériel à cause du TLS forcé. Servir des fichiers textes écrits en gemtext en #http est mieux dans ce cas

jalcine, to random
@jalcine@todon.eu avatar

Sigh.

> Webfinger is not part of the ActivityPub standard, but the fact that Mastodon requires it makes it de-facto mandatory.

Noticing from https://docs.rs/activitypub_federation/latest/activitypub_federation/#http-endpoints (https://jacky.wtf/2023/9/4su8)

nurkiewicz, to random
@nurkiewicz@fosstodon.org avatar
esparta, to random
@esparta@fosstodon.org avatar

This document from 2021 is still very relevant and might help you as it helped me back then:

#Plaintext #HTTP in a Modern World

https://jcs.org/2021/01/06/plaintext

> While this push for security is good for protecting modern communication, there is a whole web full of information and services that don't need to be secured and those trying to access them from older vintage computers or even through modern embedded devices are increasingly being left behind.

schizanon, to webdev

Whether or not #htmx is a good way to build #web apps; the fact that it's #API is composed of #HTML attrs, #HTTP headers, and #JavaScript #events gives big way-it-should-be vibes.

https://htmx.org/reference/

#webDev #webdevelopment

chrisgervais, to macos
@chrisgervais@hachyderm.io avatar

Anyone know of an #http parsing library or code for classic #macos? After decrypting a #SSL #TCP stream I’d love to shove it into a lib that can parse it all out and let me extract the relevant bits. I found HTTP sample code for OpenTransport but not sure if that’s right path. I may also not be thinking of the problem correctly but having fun experimenting and kinda don’t want to write it from scratch #RetroComputing #macintosh

michael, to webdev
@michael@thms.uk avatar

Anyone who's ever done any meaningful frontend work with REST APIs will know that HTML only allows GET and POST form methods.

I've often scratched my head as to why that's the case though.

Today - during a particularly lengthy compile run - I went on a bit of a search, and found this post:

https://softwareengineering.stackexchange.com/a/211790

Sadly, the answer is rather unsatisfactory ...

#HTML #HTTP #REST #API

slink, to alternative
@slink@fosstodon.org avatar

Does anyone know a good explainer how exactly common browsers implement #HTTP alternative services (alt-srv #AltSrv) #firefox #chrome #chromium #safari

https://httpwg.org/specs/rfc7838.html#alt-svc

  • All
  • Subscribed
  • Moderated
  • Favorites
  • provamag3
  • mdbf
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • DreamBathrooms
  • JUstTest
  • GTA5RPClips
  • ethstaker
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • tacticalgear
  • anitta
  • megavids
  • Leos
  • cisconetworking
  • lostlight
  • All magazines