Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The whole point of this attack is to be able to make a lot of requests for each IP address.

If you are making one or few requests per IP you don't need this attack, and also aren't likely to have any effect on a Google-sized entity.



It is a little more complicated because a request is few layers deep. In HTTP2 you open a connection, start a stream, then send a request over that stream.

Are you tracking per connection? Per stream? Isn't it normal for multiple requests to happen quite quickly? I load a single page with 50 external assets, those get multiplexed over the current stream - is that okay? Is that abusive? The other stream is handling a video player and its requesting (http2) frames of video data - too much? Too fast?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: